Connect an existing registry
Registry Relay publishes an institution’s records from one reviewed contract, not from the shape of its database. Connecting a registry is therefore an authoring task: choose which views, records, operations, callers, and properties the contract admits, then prove that choice before an operator ever sees it. Registry Stack does not infer access policy, safe fields, or published meaning from source data.
Start from reviewed SQLite views
Section titled “Start from reviewed SQLite views”Relay reads read-only SQLite and nothing else. The institution decides in SQL what leaves the system of record, and the contract then decides what leaves the API. Only views can be bound as sources, so a raw table never becomes a route. Naming any other engine as a source’s kind is a compile-time refusal, not a runtime warning.
A project can bind more than one named source, and each resource picks exactly one source and one view. Every source declares an expected schema fingerprint, a SHA-256 digest of its reviewed schema, so a source whose structure has drifted from what was reviewed refuses to compile rather than silently serving a changed shape.
relayctl inspect reports the structure you are allowed to reason about:
objects, columns, declared types, nullability, key membership, and a schema
fingerprint.
It reads no row values, and it offers no option to sample, limit, or print them.
Choose the source profile the institution can actually operate:
| Property | Snapshot | Live read-only |
|---|---|---|
| Publisher updates while Relay runs | No | Yes, through a separate trusted publisher |
| Source revision | Captured content digest | Explicitly unversioned |
| Available operations | Every declared operation | Identifier read and named exact lookup |
A live read-only source compiles only identifier read and named exact lookup
operations. A list or a collection search against a live source is a
compile-time refusal, so bounded bbox search and any other collection search
need a reviewed snapshot source instead. A published property is typed as one
of String, Boolean, Integer, Date, DateTime, Year, YearMonth, or
ControlledCode, chosen independently of the SQLite column’s own storage
type.
This path assumes a source that is, or can be exposed as, read-only SQLite views. Evidence Gateway answers a different kind of question over a different source shape: named fixed HTTP JSON requests or a reviewed SQLite extract, returned as one signed assertion rather than a published API. See Configure Evidence Gateway if a bounded, minimum-disclosure assertion is what the reader needs instead of a published Registry Relay API.
Author the contract, not the database
Section titled “Author the contract, not the database”registry.yaml is the governed agreement.
It carries Registry identity and metadata, governance records, semantics,
classifications, source bindings, resources with their operations and access
profiles, and any statistical datasets.
Every key is closed: an unknown field is a refusal, not a silently ignored line.
Base Registry Engine (BReg) compiles a file with the same name and an unrelated grammar, and the two products even use the words access profile for different objects. Where both are in view, this one is the Relay registry document and the other is the BReg registry document; a snippet copied from the wrong page does not compile.
runtime.yaml is the operator’s file.
It binds local paths, the listener, token issuers, audit storage, cursor keys,
limits, and quotas.
It cannot add a resource, enable an operation, widen an access profile, change a
classification, or relax disclosure.
Keep authored and generated files separate
Section titled “Keep authored and generated files separate”You own registry.yaml, runtime.yaml, the governance/, codelists/, and
semantics/ files the contract references, and the synthetic fixtures.
relayctl generate owns its artifact directory and relayctl package owns the
sealed package directory.
Both refuse a destination that already holds content instead of overwriting it,
so a generated tree is always the product of exactly one run.
Fixtures are synthetic and never authorize a live network request.
relayctl test replays the project’s expected requests through the same
compiled router the service uses, offline.
Choose the guide
Section titled “Choose the guide”- Publish a governed SQLite registry for a synthetic end-to-end run before any institutional source is involved
- Author a Registry Relay project for institution-owned views, access profiles, transforms, and disclosure
- Semantics, classification, and disclosure before assigning published names and handling levels to real fields
- How Relay publishes a governed Registry for the product boundary the contract sits inside