chore: retire Registry Notary and make Evidence the documented product

.claude/commands/goal.md

@@ -0,0 +1,29 @@
+---
+description: Execute the next step of the Notary retirement and Evidence onboarding plan
+argument-hint: [DoD item id, e.g. B5, or a workstream letter; empty picks the next item]
+---
+
+Work the tracked plan at `plans/notary-retirement-and-evidence-onboarding.md`.
+
+1. Read the plan in full: decisions, constraints, DoD checklist, dependency
+   order, status log. The decisions are settled; do not relitigate them.
+2. Select work. If `$ARGUMENTS` names a DoD item or workstream, target it.
+   Otherwise pick the first unchecked item whose dependencies are satisfied,
+   preferring workstream B (onboarding is the standing priority).
+3. Announce the selected item and its intended shape in one short message,
+   then execute. Only stop for input when the item is security-sensitive,
+   requires a decision the plan reserves for Jeremi (A1's Mint-for-Relay
+   branch, G4 re-approval), or turns out to conflict with a constraint.
+4. For code: TDD, failing test first. The frozen Evidence V1 rules in
+   `AGENTS.md` and `products/evidence/AGENTS.md` apply; composition work
+   must not touch Evidence production code.
+5. Verify with the gates listed in the plan's Verification section for every
+   area touched. All must pass; paste the evidence in the report.
+6. Update the plan file in the same commit as the work: tick the DoD
+   checkbox, append a dated status log line (absolute dates).
+7. Commit with `git commit -s` and a conventional prefix. Stage only files
+   belonging to this item; never sweep unrelated worktree changes.
+8. Report: what changed, verification evidence, and the next unblocked item.
+
+Never: modify frozen Evidence V1 contracts, hand-edit generated artifacts,
+scrub Notary from history pages, or log secrets.

.dockerignore

@@ -0,0 +1,5 @@
+.git
+.cargo-home
+target
+scratch
+docs/site/node_modules

.github/dependabot.yml

@@ -30,21 +30,6 @@ updates:
           - minor
           - patch
 
-  # The conformance helper lock is a pip-compile requirements file. Its direct
-  # input remains byte-bound to the reviewed upstream suite requirements.
-  - package-ecosystem: pip
-    directory: "/release/conformance/openid"
-    schedule:
-      interval: weekly
-      day: wednesday
-      time: "08:30"
-      timezone: Etc/UTC
-    open-pull-requests-limit: 1
-    groups:
-      conformance-python:
-        patterns:
-          - "*"
-
   # Pinned GitHub Actions used by the workflows.
   - package-ecosystem: github-actions
     directory: "/"
@@ -64,9 +49,7 @@ updates:
   - package-ecosystem: docker
     directories:
       - "/release/docker"
-      - "/release/conformance/openid"
       - "/crates/registry-relay"
-      - "/products/notary"
     schedule:
       interval: weekly
       day: wednesday
@@ -77,18 +60,3 @@ updates:
       docker-images:
         patterns:
           - "*"
-
-  # Docker Compose image pins use a distinct Dependabot ecosystem from
-  # Dockerfiles. Both override filenames match Dependabot's Compose matcher.
-  - package-ecosystem: docker-compose
-    directory: "/release/conformance/openid"
-    schedule:
-      interval: weekly
-      day: wednesday
-      time: "11:30"
-      timezone: Etc/UTC
-    open-pull-requests-limit: 1
-    groups:
-      docker-compose-images:
-        patterns:
-          - "*"

.github/scripts/ci_changes.py

@@ -15,49 +15,65 @@
     "platform": (
         "registry-platform-audit",
         "registry-platform-authcommon",
-        "registry-platform-cache",
         "registry-platform-canonical-json",
         "registry-platform-config",
         "registry-platform-crypto",
         "registry-platform-httpsec",
         "registry-platform-httputil",
-        "registry-platform-oid4vci",
         "registry-platform-oidc",
         "registry-platform-ops",
         "registry-platform-pdp",
-        "registry-platform-replay",
         "registry-platform-sdjwt",
         "registry-platform-testing",
     ),
     "manifest": (
         "registry-manifest-cli",
         "registry-manifest-core",
     ),
-    "notary": (
-        "registry-notary",
-        "registry-notary-client",
-        "registry-notary-core",
-        "registry-notary-server",
-        "registry-notary-worker-harness",
-        "xtask",
-    ),
     "relay": ("registry-relay",),
+    "evidence": ("registry-evidence", "registry-evidencectl"),
+    "mint": ("registry-mint",),
     "developer-tools": (
         "registry-config-report",
         "registry-language-server",
     ),
     "registryctl": ("registryctl",),
 }
 
-NOTARY_PACKAGES = frozenset(SHARDS["notary"])
+EVIDENCE_PACKAGES = frozenset(SHARDS["evidence"])
 PLATFORM_PACKAGES = frozenset(SHARDS["platform"])
 MANIFEST_PACKAGES = frozenset(SHARDS["manifest"])
 TUTORIAL_PACKAGES = frozenset(
     package
-    for shard in ("platform", "manifest", "notary", "relay", "registryctl")
+    for shard in ("platform", "manifest", "relay", "registryctl")
     for package in SHARDS[shard]
 ) | {"registry-config-report"}
 
+# Every input the Evidence tutorial gate replays or is built from. The tutorial
+# pages here must stay in step with the gate's own registry, which
+# test_ci_changes.py enforces: a tutorial CI does not watch is a tutorial that
+# rots silently.
+EVIDENCE_TUTORIAL_INPUTS = frozenset(
+    {
+        "Cargo.lock",
+        "Cargo.toml",
+        "docs/site/package-lock.json",
+        "docs/site/package.json",
+        "docs/site/scripts/check-evidence-tutorials.sh",
+        "docs/site/scripts/check-evidence-tutorials.test.mjs",
+        "docs/site/scripts/registryctl-tutorial.mjs",
+        "docs/site/src/content/docs/tutorials/author-an-acceptance-definition.mdx",
+        "docs/site/src/content/docs/tutorials/connect-an-institution-source.mdx",
+        "docs/site/src/content/docs/tutorials/first-evidence-assertion.mdx",
+        "docs/site/src/content/docs/tutorials/serve-assertions-over-http.mdx",
+        "docs/site/src/content/docs/tutorials/verify-an-assertion-as-a-consumer.mdx",
+    }
+)
+
+# The gate also builds and runs `mint`, because one tutorial serves assertions
+# to a caller holding a real Mint-issued token.
+EVIDENCE_TUTORIAL_PACKAGES = EVIDENCE_PACKAGES | frozenset(SHARDS["mint"])
+
 ROOT_RUST_INPUTS = {
     "Cargo.lock",
     "Cargo.toml",
@@ -307,8 +323,8 @@ def classify(
             if package is not None:
                 seeds.add(package)
                 continue
-            if path.startswith("products/notary/"):
-                seeds.update(NOTARY_PACKAGES)
+            if path.startswith("products/evidence/"):
+                seeds.update(EVIDENCE_PACKAGES)
             elif path.startswith("products/manifest/"):
                 seeds.update(MANIFEST_PACKAGES)
             elif path.startswith("products/platform/"):
@@ -387,7 +403,6 @@ def classify(
             "crates/registry-relay/openapi/*",
             "crates/registry-relay/src/api/openapi.rs",
             "crates/registryctl/assets/project-starters/*",
-            "crates/registry-notary-server/src/standalone/activation.rs",
             "crates/registry-platform-ops/src/lib.rs",
             "crates/registry-relay/src/consultation/*",
             "crates/registryctl/schemas/project-reports/*",
@@ -396,8 +411,6 @@ def classify(
             "crates/registryctl/tests/fixtures/project-reports/*",
             "docs/site/*",
             "products/manifest/docs/*",
-            "products/notary/docs/*",
-            "products/notary/openapi/*",
             *AUTHORING_REFERENCE_PATTERNS,
         )
         or path
@@ -472,18 +485,13 @@ def classify(
             "docs/site/src/content/docs/tutorials/use-your-spreadsheet.mdx",
             "docs/site/src/content/docs/tutorials/verify-claim-registry-api.mdx",
             "docs/site/src/content/docs/tutorials/verify-opencrvs-claims.mdx",
-            "release/docker/Dockerfile.registry-notary",
             "release/docker/Dockerfile.registry-relay",
         }
-        or path.startswith("products/notary/")
         for path in paths
     )
     tutorial_source_under_test = any(
         matches(
             path,
-            "crates/registry-notary/src/*",
-            "crates/registry-notary-core/src/*",
-            "crates/registry-notary-server/src/*",
             "crates/registryctl/src/templates/*",
         )
         or path
@@ -503,6 +511,12 @@ def classify(
         or bool(affected & TUTORIAL_PACKAGES)
     )
 
+    evidence_tutorial = (
+        complete
+        or any(path in EVIDENCE_TUTORIAL_INPUTS for path in paths)
+        or bool(affected & EVIDENCE_TUTORIAL_PACKAGES)
+    )
+
     matrix = []
     for shard_name, shard_packages in SHARDS.items():
         selected = sorted(affected.intersection(shard_packages))
@@ -521,15 +535,16 @@ def classify(
         "rust_packages": sorted(affected),
         "platform": platform,
         "platform_hygiene": platform_hygiene,
-        "notary_contracts": bool(affected & NOTARY_PACKAGES),
         "relay_contracts": "registry-relay" in affected,
+        "evidence_contracts": bool(affected & EVIDENCE_PACKAGES),
         "project_authoring": "registryctl" in affected,
         "release_tool": release_tool,
         "release_source_proof": release_source_proof,
         "docs": docs,
         "docs_archives": docs_archives,
         "editors": editors,
         "registryctl_tutorial": registryctl_tutorial,
+        "evidence_tutorial": evidence_tutorial,
     }