Registry stack documentation: machine-readable Markdown.
Index of all pages: https://docs.registrystack.org/llms.txt
Full corpus: https://docs.registrystack.org/llms-full.txt

# Prepare the operator handoff

> Receive a sealed Registry Relay package, bind it to local deployment inputs, and replace complete revisions without gaining hidden authority.

The authoring environment is disposable.
What crosses into a deployment is one sealed package, one matching SQLite
source, and one reviewed change report.
The operator binds those to local paths, keys, issuers, and limits, and can
change none of the meaning inside them.

## Handoff sequence

| Stage | Command | Result owner |
| --- | --- | --- |
| Classify the change | `relayctl diff <previous> <current>` | Registry Authority reviewer |
| Prove governance | `relayctl check <project> --production` | Data publisher |
| Replay fixtures | `relayctl test <project>` | Data publisher |
| Seal the revision | `relayctl package <project> --output <dir>` | Data publisher |
| Bind the deployment | `runtime.yaml` | Deployment operator |
| Run | `relay serve --runtime <file>` | Deployment operator |
| Confirm | `GET /health` and `GET /ready` | Deployment operator |

Packaging recompiles the project under the production profile, so a package
cannot be produced from a revision that would fail `check --production`.
Generation and packaging never start a service or resolve a secret. Packaging
does open each bound source read-only to observe its structure, and refuses when
a binding cannot be observed.

## Obtain the runtime

The installer publishes one binary, `relay`, and accepts one platform, Linux
amd64:

```sh
curl -fsSL https://github.com/registrystack/registry-stack/releases/latest/download/relay-install.sh | bash
```

The installer verifies the downloaded binary against the release `SHA256SUMS`
before anything reaches the install directory, and refuses any other platform
rather than guessing. It does not verify release authenticity.
For a higher-assurance installation, follow
[release verification](https://github.com/registrystack/registry-stack/blob/v0.20.1/release/VERIFY.md)
for the pinned tag, then rerun the installer with `RELAY_ASSET_DIR` pointing at
the verified directory.
`RELAY_INSTALL_DIR` selects the install directory; the default is
`~/.local/bin`.

The container image is `ghcr.io/registrystack/relay:v0.20.1`, built on
distroless nonroot. It exposes port 8080, runs `relay serve --runtime
/etc/relay/runtime.yaml` by default, and probes itself with `relay healthcheck`.

`relayctl` has no installer. It ships as a plain release binary for three
platforms, `relayctl-<tag>-linux-amd64`, `relayctl-<tag>-linux-arm64`, and
`relayctl-<tag>-macos-arm64`. Take the asset directly, or build it from source.
Operators who prefer to place `relay` themselves take the
`relay-<tag>-linux-amd64` asset the same way.

## Record operator-owned inputs

Before the first activation, record:

- The package directory, its `packageRevision`, and the contract revision it seals
- The SQLite source path and the source profile the package already chose
- The token issuer identity, discovery URL, audience, and accepted algorithms,
  or the decision that the deployment is fully anonymous
- The audit sink path, its integrity key reference, and its retention policy
- The cursor integrity key reference and maximum cursor age
- The listener address, the TLS termination point, and the limits and quotas
- The Unix service identity that owns every trusted path

Relay resolves secrets through `secret:env/<NAME>` or `secret:file/<name>`
references in `runtime.yaml`, where `<name>` is a single flat lowercase
filename. Secret values never belong in the package, and the
package never travels with the database.

## The package proves integrity, not authenticity

`packageRevision` is a SHA-256 digest over the canonicalized package manifest.
It detects a modified or truncated package. It is not a signature, and Registry
Relay does not sign packages or responses.
Authenticity is whatever the institution's transfer, storage, and access
controls make it, so treat the package like any other trusted deployment
artifact.

At startup `relay serve` re-derives the compiled registry and the entire
artifact set from the governed files inside the package and requires
byte-for-byte equality before it activates.
On Unix it also refuses symbolic links and group-writable or world-writable
components in the runtime and package paths; on other platforms that check fails
closed and the service does not start.

## Use the operations guidance

- [Operate Registry Relay](relay/) for sources, issuers, audit, limits, and
  revision replacement
- [Retention and persistent state](retention-and-persistent-state/) for what
  each product keeps and what an operator must preserve
- [Advanced operations](advanced/) for cross-product credential, trust, and
  runtime-inspection procedures

## Next

- [Understand generated files](../generated-artifacts/)
- [Review the security guidance](../security/)
- [Report a vulnerability](../security/report-a-vulnerability/)