Prepare the operator handoff

View as Markdown

The authoring environment is disposable. What crosses into a deployment is one sealed package, one matching SQLite source, and one reviewed change report. The operator binds those to local paths, keys, issuers, and limits, and can change none of the meaning inside them.

Handoff sequence

Stage	Command	Result owner
Classify the change	`relayctl diff <previous> <current>`	Registry Authority reviewer
Prove governance	`relayctl check <project> --production`	Data publisher
Replay fixtures	`relayctl test <project>`	Data publisher
Seal the revision	`relayctl package <project> --output <dir>`	Data publisher
Bind the deployment	`runtime.yaml`	Deployment operator
Run	`relay serve --runtime <file>`	Deployment operator
Confirm	`GET /health` and `GET /ready`	Deployment operator

Packaging recompiles the project under the production profile, so a package cannot be produced from a revision that would fail check --production. Generation and packaging never start a service or resolve a secret. Packaging does open each bound source read-only to observe its structure, and refuses when a binding cannot be observed.

Obtain the runtime

The installer installs the relay and relayctl binaries together and accepts the platforms in platform support:

curl -fsSL https://github.com/registrystack/registry-stack/releases/latest/download/relay-install.sh | bash

The installer verifies both downloaded binaries against the release SHA256SUMS before anything reaches the install directory, installs both or neither, and refuses any other platform rather than guessing. It does not verify release authenticity. The signed checksum chain that does, and the checks behind it, are recorded in OpenSSF and release trust. Replace | bash with | less to read the installer before you run it on a host you operate. For a higher-assurance installation, follow release verification for the pinned tag, then rerun the installer with RELAY_ASSET_DIR pointing at the verified directory. RELAY_INSTALL_DIR selects the install directory; the default is ~/.local/bin.

The container image is ghcr.io/registrystack/relay:v0.26.1, built on distroless nonroot. It exposes port 8080, runs relay serve --runtime /etc/relay/runtime.yaml by default, and probes itself with relay healthcheck.

relayctl also ships as a plain release binary for each platform in platform support: relayctl-<tag>-linux-amd64, relayctl-<tag>-linux-arm64, and relayctl-<tag>-macos-arm64. Take the asset directly when the combined installer does not support the target platform, or build it from source. Operators who prefer to place relay themselves take the relay-<tag>-linux-amd64 asset the same way.

Record operator-owned inputs

Before the first activation, record:

The package directory, its packageRevision, and the contract revision it seals
The SQLite source path and the source profile the package already chose
The token issuer identity, discovery URL, audience, and accepted algorithms, or the decision that the deployment is fully anonymous
The audit sink path, its integrity key reference, and its retention policy
The cursor integrity key reference and maximum cursor age
The listener address, the TLS termination point, and the limits and quotas
The Unix service identity that owns every trusted path

Relay resolves secrets through secret:env/<NAME> or secret:file/<name> references in runtime.yaml, where <name> is a single flat lowercase filename. Secret values never belong in the package, and the package never travels with the database.

The package proves integrity, not authenticity

packageRevision is a SHA-256 digest over the canonicalized package manifest. It detects a modified or truncated package. It is not a signature, and Registry Relay does not sign packages or responses. Authenticity is whatever the institution’s transfer, storage, and access controls make it, so treat the package like any other trusted deployment artifact.

At startup relay serve re-derives the compiled registry and the entire artifact set from the governed files inside the package and requires byte-for-byte equality before it activates. On Unix it also refuses symbolic links and group-writable or world-writable components in the runtime and package paths; on other platforms that check fails closed and the service does not start.

Use the operations guidance

Operate Registry Relay for sources, issuers, audit, limits, and revision replacement
Retention and persistent state for what each product keeps and what an operator must preserve
Advanced operations for cross-product credential, trust, and runtime-inspection procedures