Configuration files

View as Markdown

Every Registry Stack product reads YAML configuration files. A project author writes authored files, such as a registry project or a Casework policy, and an operator writes a runtime file for each deployment. This reference covers how a file starts, how a runtime reads its configuration file, how to read a diagnostic, and which command checks each file before you deploy it. Formats by product lists every file a product reads and links to the reference for its keys.

Where the shared rules apply

One shared reader reads the runtime configuration file of each of these programs:

Base Registry Engine (BReg), BRegRuntimeConfig
Evidence Gateway, EvidenceRuntimeConfig
Registry Casework, CaseworkRuntimeConfig
Registry Scheduling, SchedulingRuntimeConfig
Registry Render, RenderRuntimeConfig
Registry Discovery, DiscoveryRuntimeConfig

The BReg citizen gateway, breg-mcp, reads BRegMcpRuntimeConfig through the same reader, and the citizen review page, breg-review, reads BRegReviewRuntimeConfig.

Registry Messaging reads MessagingRuntimeConfig through the same reader.

The shared reader is the registry-platform-yaml library. Every product’s check command reads its authored files through it, as the runtimes above read their runtime files, so one YAML subset, one value table, one header check, and one diagnostic format apply to every file on this page that is not marked External format or Exchange model; those files follow the grammar of the project that owns them, as formats by product explains. Two rules belong to runtime files alone: the absolute path in how a runtime reads its file, and ${...} substitution in values from the environment. The reference linked for each format describes its keys.

How a file starts

A file whose format carries a header starts with apiVersion and kind, two plain strings at the top level:

apiVersion: id.registrystack.org/formats/discovery/runtime/v1alpha1
kind: DiscoveryRuntimeConfig

apiVersion names the format and its version; kind names the document. A runtime checks both before it decodes the rest of the file, and refuses a pair it does not read. Write both in the file as plain text: neither can come from an environment variable. The Header column under formats by product gives each format’s pair. A format marked No apiVersion or No kind does not carry that member.

How a runtime reads its file

A runtime reads its configuration file only from an absolute path with no . or .. segment and no symbolic link anywhere along it, and only when that path names a regular file. Every file the reader reads, authored or runtime, is at most 1 MiB and is one YAML document in a strict subset of YAML 1.2, in UTF-8, nested at most 128 levels deep. Write block mappings and lists, indent with spaces, and add comments wherever they help. The reader refuses these constructs, each with its own code:

Written	Refused with
A tab in indentation	`yaml.tab-indentation`
The same key twice in one mapping	`yaml.duplicate-key`
An anchor (`&name`) or an alias (`*name`)	`yaml.anchor`, `yaml.alias`
A merge key (`<<`)	`yaml.merge-key`
An explicit tag, such as `!!str` or `!custom`	`yaml.tag`
A mapping key that is not a string	`yaml.non-string-key`
A second document after `---`	`yaml.multiple-documents`

A runtime file cannot reuse a block it already wrote: repeat the values instead. A key that starts with x- is not an extension point. The reader refuses it as an unknown key and asks you to write the note as a comment.

How an unquoted value is read

The reader resolves an unquoted value by one table, the same in every runtime:

Unquoted value	Read as
`null`, `Null`, `NULL`, `~`, or nothing after the colon	Null
`true`, `True`, `TRUE`, `false`, `False`, `FALSE`	Boolean
Digits with an optional sign and no leading zero: `0`, `42`, `-7`	Integer
The same with a fraction or an exponent: `1.5`, `-0.25`, `1e3`	Number
`0123`, `01.5`, `.5`, `5.`, `0x1F`, `0o17`, `0b101`, `.inf`, `.nan`	Refused with `yaml.ambiguous-number`
Anything else, including `yes`, `no`, `on`, `off`, `1_000`, `1:30`, and `09:00`	Text

A quoted value and a block value (| or >) are always text. So yes and on never mean true, and a value such as 09:00 stays the text you wrote.

A member keeps the type its format gives it. An integer member refuses 1_000 and refuses a quoted "100", and a text member refuses an unquoted number or boolean until you quote it. With maximumResultRecords: "100" in a Discovery runtime file, the reader reports:

error[config.expected-integer] runtime.yaml:11:25 /limits/maximumResultRecords
  expected a whole number from 1 to 10000; quoted values are text
  next: Remove the quotes.

A message about a whole number states both bounds: the ones the format declares, as here, or else the range of the member’s type.

Absent and null

Leaving a key out and writing it with no value are different. An optional key you leave out takes its default. A key with nothing after the colon, or with null or ~, is null, and no member accepts null. In a Scheduling runtime file, authentication.oidc.scopeClaim is optional and defaults to registry_scopes. With scopeClaim: on a line of its own, the reader reports it under schedulingctl check <project> --runtime-config runtime.yaml:

error[config.null-value] runtime.yaml:79:5 /authentication/oidc/scopeClaim
  null is never a value; an empty value after a key is null too
  next: Give a value, or remove the key if the member is optional.

Values from the environment

A runtime file can take part of a text value from the runtime’s environment while it is read:

Expression	Result
`${NAME}`	The value of `NAME`; refused when `NAME` is unset or empty
`${NAME:-fallback}`	The value of `NAME`, or `fallback` when `NAME` is unset or empty
`${NAME:?message}`	The value of `NAME`; refused when `NAME` is unset or empty, naming `NAME` and withholding the message

NAME starts with a letter or _ and continues with letters, digits, or _. An expression can sit inside a longer value, such as ${PACKAGE_ROOT}/current.

A substituted value is text. It fills a text member and never an integer or boolean member; write numbers and booleans in the file.
Substitution is refused in keys, in apiVersion and kind, in every member whose key ends in Ref or Refs and everything nested in it, and everywhere under secretProviders.
There is no escape syntax. ${ followed by a letter, a digit, _, or } starts an expression, and any other ${ is text. Substitution is a single pass, so a value that needs a literal expression can come from an environment variable that holds it.
A diagnostic about a substituted value points at the expression as you wrote it, and names the variable but never its value.

A check command fills expressions only when you pass --environment. With DISCOVERY_PACKAGE_ROOT unset, discoveryctl check --runtime-config runtime.yaml --environment refuses root: ${DISCOVERY_PACKAGE_ROOT}:

error[config.substitution] runtime.yaml:6:9 /package/root
  the environment variable DISCOVERY_PACKAGE_ROOT is unset or empty
  next: Set DISCOVERY_PACKAGE_ROOT in the runtime's environment, or write a fallback as ${DISCOVERY_PACKAGE_ROOT:-fallback}.

With root: ${DISCOVERY_PACKAGE_ROOT:?set the package root} and the variable unset, the refusal names the variable and says the message you wrote is withheld, since a message is configured text that can end up in a log:

error[config.substitution] runtime.yaml:6:9 /package/root
  the environment variable DISCOVERY_PACKAGE_ROOT is unset or empty; the message written for it is withheld
  next: Set DISCOVERY_PACKAGE_ROOT in the runtime's environment.

Substitution is for ordinary settings. A secret goes in a reference member, a key ending in Ref, as secret:env/<NAME> or secret:file/<name>, and the runtime resolves it through the providers its file declares under secretProviders. The secret reference grammar gives the accepted names.

An authored file is never substituted. A check command refuses a ${...} expression in one with config.substitution-not-allowed, so write the value itself.

Read a diagnostic

A check command, and a runtime that refuses its file at startup, report diagnostics, one per problem. Take a Discovery runtime file whose last line misspells logLevel:

apiVersion: id.registrystack.org/formats/discovery/runtime/v1alpha1
kind: DiscoveryRuntimeConfig
listener:
  bind: 127.0.0.1:38080
  requestTimeoutMilliseconds: 10000
package:
  root: /srv/discovery/current
limits:
  maximumRequestBytes: 65536
  maximumResponseBytes: 1048576
  maximumResultRecords: 100
  maximumResultAlternatives: 100
  shutdownGraceMilliseconds: 10000
logLevl: info

discoveryctl check --runtime-config runtime.yaml reports two problems and a summary line:

discoveryctl check refused the input.
error[config.missing-key] runtime.yaml:1:1
  the required member `logLevel` is missing
  next: Add `logLevel`.
error[config.unknown-key] runtime.yaml:14:1 /logLevl
  `logLevl` is not a member of this mapping
  next: Rename `logLevl` to `logLevel`, or remove it.
2 errors, 0 warnings in 1 file

Each diagnostic has the same parts:

Part	Example	Meaning
Severity	`error`	`error` refuses the file; `warning` reports a problem the runtime still accepts
Code	`config.unknown-key`	The problem, by a stable name
Position	`runtime.yaml:14:1`	File, line, and column, counted from 1
Pointer	`/logLevl`	Where the key sits in the document, as an RFC 6901 JSON Pointer; absent when the problem is at the root
Message	`logLevl` is not a member of this mapping	What is wrong
`next:`	Rename `logLevl` to `logLevel`, or remove it.	The fix to make
`note:`	`runtime.yaml:3:1 /listener the first definition`	A second place that explains the problem, when there is one

The examples on this page name the file runtime.yaml. A runtime names the file by the path you gave it. A message names keys, accepted values, and bounds, and never repeats a value read from the file or the environment.

A duplicate key shows a note: line that points at the first definition:

error[yaml.duplicate-key] runtime.yaml:15:1 /listener
  the key is already defined in this mapping
  next: Keep one definition of the key.
  note: runtime.yaml:3:1 /listener the first definition

A check finds problems in passes. The first pass reads the file’s structure (YAML syntax and the header) and reports every structural problem together; a file with one is not decoded. The second pass decodes the file, reports every unknown and removed key it finds, and stops at the first other problem in a document. The third pass applies the semantic checks, and runs only on a file that decoded without error. A check therefore reports every problem it finds in a pass, not every problem the file has. Fix what it reports and run the check again: a later pass can report more. It shows at most 100 diagnostics for one file, then one config.too-many-problems diagnostic that counts the rest.

Codes

A reader code has two parts. yaml. codes concern the YAML subset, and config. codes concern the header, keys, and values. A code with three parts, such as platform.runtime-config.path, comes from the runtime loader or the product rather than the reader. These are the reader codes a runtime file most often meets:

Code	Meaning
`config.missing-envelope`	The document is empty, or its top-level mapping lacks `apiVersion` or `kind`
`config.wrong-kind`	`kind` is not one the reader accepts
`config.unsupported-api-version`	`apiVersion` is not one the reader accepts for this kind
`config.retired-api-version`	`apiVersion` is one an earlier release wrote; `next:` names the current one
`config.unknown-key`	A key is not a member of its mapping
`config.removed-key`	A key was removed or renamed; `next:` names what to write instead
`config.missing-key`	A required member is absent
`config.unknown-variant`	A value is not one of the accepted names; the message lists them
`config.null-value`	A member is null
`config.invalid-value`	A value has the right type but a product rule refuses it; the message states what is accepted
`config.expected-integer`	An integer member holds something other than an integer
`config.expected-string`	A text member holds something other than text
`config.substitution`	A `${...}` expression cannot be filled
`config.substitution-not-allowed`	A `${...}` expression is written where substitution is refused
`config.too-many-problems`	The file has more problems than the reader shows; this last diagnostic counts the rest
`yaml.duplicate-key`	A mapping holds the same key twice
`yaml.ambiguous-number`	An unquoted value looks like a number but is not a plain decimal
`yaml.invalid-escape`	A backslash in a double-quoted value starts an escape sequence YAML does not define
`yaml.text-after-quote`	Text follows the closing quote of a quoted value
`yaml.control-character`	A text value holds a control character other than tab, line feed, or carriage return

CODES in crates/registry-platform-yaml/src/messages.rs lists every reader code with its meaning. The reader’s one warning, config.deprecated-api-version, reports an apiVersion the runtime still reads and names the version to change to.

For an unknown key, next: proposes the closest accepted key when one differs only in letter case, or by at most two edits (one edit for an accepted key of four characters or fewer, counting a swap of two neighbouring characters as one edit). Otherwise it lists the accepted keys, once per mapping: a later unknown key in the same mapping points at the line that lists them.

The same rule applies to accepted values. With logLevel: inf in the Discovery runtime file, the reader reports:

error[config.unknown-variant] runtime.yaml:14:11 /logLevel
  expected one of `error`, `warn`, `info`
  next: Use `info`, the closest accepted value.

With logLevel: Info, next: reads Use `info`; letter case matters. instead. Otherwise it lists the accepted values. A value filled from the environment gets the list and no proposal, since a proposal would reveal part of the value.

A few blocks are exceptions, such as audit in the Casework runtime file. These blocks are decoded outside the reader’s key checks, so a check stops at the first unknown key in them, and next: asks you to remove it without proposing or listing accepted keys.

The code names the problem. The message wording is human-readable output, which API stability places outside its promise.

Fix a removed key, a retired version, or an empty list

A key that a format used to accept is refused with a sentence that says what to write instead. A Discovery runtime file that still says address under listener is refused:

discoveryctl check refused the input.
error[config.missing-key] runtime.yaml:3:1 /listener
  the required member `bind` is missing
  next: Add `bind`.
error[config.removed-key] runtime.yaml:4:3 /listener/address
  `address` is no longer accepted
  next: Declare listener.bind instead.
2 errors, 0 warnings in 1 file

Rename the key, and both problems go away. A header that carries a retired apiVersion is refused the same way, with the current one named. A Scheduling runtime file that starts with the earlier registry.registrystack.org/scheduling-runtime/v1alpha1 is refused by schedulingctl check <project> --runtime-config runtime.yaml:

error[config.retired-api-version] runtime.yaml:17:13 /apiVersion
  apiVersion `registry.registrystack.org/scheduling-runtime/v1alpha1` is retired; the current apiVersion is `id.registrystack.org/formats/scheduling/runtime/v1alpha1`
  next: Write apiVersion: id.registrystack.org/formats/scheduling/runtime/v1alpha1.
1 error, 0 warnings in 5 files

An empty list never states an open choice. Where a member can be open, you write the word unrestricted in place of the list, and an empty list is refused with that fix. With requiredScopes: [] in a Base Registry Engine access profile, bregctl check my-registry reports:

bregctl check refused the project.
error[config.invalid-value] my-registry/registry.yaml:58:21 /accessProfiles/0/requiredScopes
  expected unrestricted, or a list of at least one scope
  next: List the scopes a token must carry, or write unrestricted to require none.
1 error, 0 warnings in 2 files

Check a file before you deploy it

The Check command column under formats by product names the command that checks each format without starting the service. Run it in your pipeline before you deploy, against the project directory or runtime file it names. A format marked None has no check command of its own; the program that reads it refuses it when it starts.

A check command that takes a project takes the project directory, not a file inside it (discoveryctl names it with --project), and a --runtime-config argument names the runtime file. Both accept a relative or an absolute path; bregctl check also refuses a project path with a .. component, so name the directory from its parent or give its absolute path. bregctl check reg, bregctl check "$PWD/reg", schedulingctl check scheduling, and schedulingctl check scheduling --runtime-config scheduling/runtime.yaml all run. A command that goes beyond an offline check, such as bregctl doctor, may require an absolute runtime file; its reference says so.

Every check command reads its files through the shared reader, applies the rules the runtime would apply that need no network or database, and reads no secret. It reports in two forms and ends with an exit code.

Human output is the default. It prints a line naming the command’s verdict, each diagnostic as described in read a diagnostic, and a summary line that counts errors, warnings, and files checked. A file with no problem prints only the summary:

0 errors, 0 warnings in 1 file

JSON output, selected by --format json, prints one report on standard output. A tool reads diagnostics, whose members mirror the human line: severity, code, artifact, path, message, suggestedAction, source (file, line, column), and related when a second place explains the problem. discoveryctl check --runtime-config runtime.yaml --format json on the misspelled file above prints:

{
  "ok": false,
  "command": "check",
  "status": "domain-refusal",
  "apiVersion": "id.registrystack.org/formats/discovery/ctl-report/v1alpha1",
  "diagnostics": [
    {
      "artifact": "DiscoveryRuntimeConfig",
      "code": "config.missing-key",
      "message": "the required member `logLevel` is missing",
      "path": "",
      "severity": "error",
      "source": {
        "column": 1,
        "file": "runtime.yaml",
        "line": 1
      },
      "suggestedAction": "Add `logLevel`."
    },
    {
      "artifact": "DiscoveryRuntimeConfig",
      "code": "config.unknown-key",
      "message": "`logLevl` is not a member of this mapping",
      "path": "/logLevl",
      "severity": "error",
      "source": {
        "column": 1,
        "file": "runtime.yaml",
        "line": 14
      },
      "suggestedAction": "Rename `logLevl` to `logLevel`, or remove it."
    }
  ],
  "errors": 2,
  "filesChecked": 1,
  "kind": "DiscoveryCtlReport",
  "warnings": 0
}

The report envelope (ok, command, status, kind, apiVersion, the counts) differs by product; the diagnostics inside it do not. path is empty when the problem concerns the whole document.

Exit codes are the same for every check command:

Exit code	Meaning
0	No error was reported; warnings are allowed
1	The input was refused
2	The command line was wrong
3	Something the command depends on was unavailable, such as a file it could not read

Warnings do not fail a check by default. A check reports a warning for a file it accepts but that probably does not say what its author meant.

A Registry Messaging project whose access profile lists requesterClients: ["*"] passes with a warning, since the item names one entry and matches nothing else:

warning[messaging.project.wildcard-spelled-item] ./messaging.yaml:43:24 /accessProfiles/0/requesterClients/0
  The item is spelled like a wildcard but names one entry: `*` and `unrestricted` match nothing else in this list.
  next: Name the entry the profile is for.
0 errors, 1 warning in 18 files

Add --deny-warnings to make a reported warning exit 1, so a pipeline fails on it.

For a runtime file, --environment fills ${NAME} expressions from the process environment and checks the values they produce. Without it, each expression is checked by syntax and position only, and no secret is read. bregctl doctor --runtime-config <absolute-file> goes further than a check: it also connects to the database and the other dependencies the file names, so it is a deployment preflight rather than an offline check.

Without --environment, the check reads the rest of the file by putting a placeholder in place of each value that holds an expression. When a member refuses its placeholder, the check stops there and reports the warning platform.runtime-config.check-incomplete at that member. The members after it were not checked, so run the check again with --environment.

Check as you type

A format with a Schema $id has a JSON Schema your editor can apply. The $id identifies the schema; it is not an address the project serves. Copy the schema file from its Source copy path, at the release you deploy, into your project, then map it to your files. The Base Registry Engine projects section of the evidencectl reference shows the mapping in .vscode/settings.json. An editor that uses yaml-language-server also reads a schema named in a comment at the top of a file:

# yaml-language-server: $schema=./schemas/runtime.schema.json
apiVersion: id.registrystack.org/formats/breg/runtime/v1alpha1
kind: BRegRuntimeConfig

The reader treats that line as a comment. For an Evidence Gateway authoring project, evidencectl tooling editor <project> writes the mappings for you, as editor support describes. A schema catches shape errors as you type. It does not replace the check command, which also applies rules a schema cannot state, such as references between files.

Stability

The Stability column gives each format’s label in the format registry:

Promised: the format is meant to be covered by API stability and versioning. The promised products table there names the configuration formats the promise covers; where the two differ, that table holds.
Experimental: shipped, and may change in a minor release, announced with a BREAKING: note.
Unpromised: no compatibility promise, for files such as fixtures, test journeys, development clients, and the Evidence Gateway authoring files.

Before v1.0.0, the pre-1.0 rule applies to every format: a minor release may change one, with a BREAKING: entry and migration steps in the release note.

Formats by product

Each product lists the files it reads, with the pages that explain their keys:

Audience: Authored for a file a project author writes, Operator for a file an operator writes for one deployment.
Header: the apiVersion and kind the file carries. External format marks a file whose grammar another project owns, such as a JSON Schema or an OpenAPI description. Exchange model marks a published data model whose member names its specification fixes. Neither carries a Registry Stack header.
Schema $id: the identifier of the format’s JSON Schema, with the repository path of its source copy.
Check command and Stability: as described in the two previous sections.

Generated files, which no one writes by hand, are left out.

Evidence Gateway

Explained in Evidence Gateway configuration reference.

Format and files	Audience	Header	Schema `$id`	Check command	Stability
Evidence bundle `evidence.yaml`	Authored	`apiVersion: id.registrystack.org/formats/evidence/bundle/v1` `kind: EvidenceBundle`	`https://id.registrystack.org/schemas/evidence/bundle/bundle.v1.schema.json`Source copy: `products/evidence/contracts/bundle.schema.yaml`	`evidence check --runtime-config <runtime>`Evidence Gateway reference	Promised
Evidence runtime configuration `runtime.yaml`	Operator	`apiVersion: id.registrystack.org/formats/evidence/runtime/v1alpha1` `kind: EvidenceRuntimeConfig`	`https://id.registrystack.org/schemas/evidence/runtime/runtime.v1alpha1.schema.json`Source copy: `products/evidence/contracts/runtime.schema.yaml`	`evidence check --runtime-config <file>`Evidence Gateway reference	Promised
Evidence code list `codelists/*.yaml`	Authored	`apiVersion: id.registrystack.org/formats/evidence/codelist/v1alpha1` `kind: EvidenceCodelist`	`https://id.registrystack.org/schemas/evidence/codelist/codelist.v1alpha1.schema.json`Source copy: `products/evidence/generated/codelist/codelist.schema.json`	`evidence check --runtime-config <runtime>`Evidence Gateway reference	Promised
Evidence fixture set `fixtures/*.yaml`	Authored	`apiVersion: id.registrystack.org/formats/evidence/fixture/v1alpha1` `kind: EvidenceFixture`	`https://id.registrystack.org/schemas/evidence/fixture/fixture.v1alpha1.schema.json`Source copy: `products/evidence/generated/fixture/fixture.schema.json`	`evidencectl test <project>`Evidence Gateway reference	Unpromised
Evidence authoring project marker `evidence-project.yaml`	Authored	`apiVersion: id.registrystack.org/formats/evidence/authoring-project/v1alpha1` `kind: EvidenceAuthoringProject`	`https://id.registrystack.org/schemas/evidence/authoring-project/authoring-project.v1alpha1.schema.json`Source copy: `crates/registry-evidencectl/schemas/authoring/project-marker.schema.json`	`evidencectl check <project>`Evidence Gateway reference	Unpromised
Evidence authoring question `questions/*.yaml`	Authored	`apiVersion: id.registrystack.org/formats/evidence/question/v1alpha1` `kind: EvidenceQuestion`	`https://id.registrystack.org/schemas/evidence/question/question.v1alpha1.schema.json`Source copy: `crates/registry-evidencectl/schemas/authoring/question.schema.json`	`evidencectl check <project>`Evidence Gateway reference	Unpromised
Evidence authoring source `sources/*.yaml`	Authored	`apiVersion: id.registrystack.org/formats/evidence/source/v1alpha1` `kind: EvidenceSource`	`https://id.registrystack.org/schemas/evidence/source/source.v1alpha1.schema.json`Source copy: `crates/registry-evidencectl/schemas/authoring/source.schema.json`	`evidencectl check <project>`Evidence Gateway reference	Unpromised
Evidence authoring selector `selectors/*.yaml`	Authored	`apiVersion: id.registrystack.org/formats/evidence/selector/v1alpha1` `kind: EvidenceSelector`	`https://id.registrystack.org/schemas/evidence/selector/selector.v1alpha1.schema.json`Source copy: `crates/registry-evidencectl/schemas/authoring/selector.schema.json`	`evidencectl check <project>`Evidence Gateway reference	Unpromised
Evidence authoring data schema `schemas/*.schema.yaml`	Authored	External formatNo Registry Stack header	None	None	Unpromised
Retained source OpenAPI description `source.openapi.yaml`	Authored	External formatNo Registry Stack header	None	None	Unpromised
Evidence access policy `access/policies/*.yaml`	Authored	`apiVersion: id.registrystack.org/formats/evidence/access-policy/v1alpha1` `kind: EvidenceAccessPolicy`	`https://id.registrystack.org/schemas/evidence/access-policy/access-policy.v1alpha1.schema.json`Source copy: `crates/registry-evidencectl/schemas/authoring/access-policy.schema.json`	`evidencectl check <project>`Evidence Gateway reference	Unpromised
Evidence access client `access/clients/*.yaml`	Authored	`apiVersion: id.registrystack.org/formats/evidence/access-client/v1alpha1` `kind: EvidenceAccessClient`	`https://id.registrystack.org/schemas/evidence/access-client/access-client.v1alpha1.schema.json`Source copy: `crates/registry-evidencectl/schemas/authoring/access-client.schema.json`	`evidencectl check <project>`Evidence Gateway reference	Unpromised
Evidence deployment target governance `governance.yaml`	Operator	`apiVersion: id.registrystack.org/formats/evidence/target-governance/v1alpha1` `kind: EvidenceTargetGovernance`	`https://id.registrystack.org/schemas/evidence/target-governance/target-governance.v1alpha1.schema.json`Source copy: `crates/registry-evidencectl/schemas/authoring/target-governance.schema.json`	`evidencectl check <project> --target <target>`Evidence Gateway reference	Unpromised
Evidence deployment target settings `targets/*/settings.yaml`	Operator	`apiVersion: id.registrystack.org/formats/evidence/target-settings/v1alpha1` `kind: EvidenceTargetSettings`	`https://id.registrystack.org/schemas/evidence/target-settings/target-settings.v1alpha1.schema.json`Source copy: `crates/registry-evidencectl/schemas/authoring/target-settings.schema.json`	`evidencectl check <project>`Evidence Gateway reference	Unpromised
Evidence source mock plan `mocks/source.yaml`	Authored	`apiVersion: id.registrystack.org/formats/evidence/mock-plan/v1alpha1` `kind: EvidenceMockPlan`	`https://id.registrystack.org/schemas/evidence/mock-plan/mock-plan.v1alpha1.schema.json`Source copy: `crates/registry-evidencectl/schemas/authoring/mock-plan.schema.json`	`evidencectl source mock check <project>`Evidence Gateway reference	Unpromised
Evidence relying-procedure verification policy `verification*.policy.yaml`	Operator	`apiVersion: id.registrystack.org/formats/evidence/verification-policy/v1` `kind: EvidenceVerificationPolicy`	`https://id.registrystack.org/schemas/evidence/verification-policy/verification-policy.v1.schema.json`Source copy: `products/evidence/contracts/verification-policy.schema.yaml`	`evidence check-policy --verification-policy <file>`Evidence Gateway reference	Promised
Evidence holder-bound presentation verification policy `holder-bound*.policy.yaml`	Operator	`apiVersion: id.registrystack.org/formats/evidence/holder-bound-verification-policy/v1` `kind: EvidenceHolderBoundVerificationPolicy`	`https://id.registrystack.org/schemas/evidence/holder-bound-verification-policy/holder-bound-verification-policy.v1.schema.json`Source copy: `products/evidence/contracts/holder-bound-verification-policy.schema.yaml`	`evidence check-policy --holder-bound-policy <file>`Evidence Gateway reference	Promised
OID4VCI delivery runtime configuration `runtime.yaml`	Operator	`apiVersion: id.registrystack.org/formats/evidence/oid4vci-runtime/v1alpha1` `kind: EvidenceOid4vciRuntimeConfig`	`https://id.registrystack.org/schemas/evidence/oid4vci-runtime/oid4vci-runtime.v1alpha1.schema.json`Source copy: `products/evidence/generated/oid4vci-runtime/oid4vci-runtime.schema.json`	`evidence-oid4vci check --runtime-config <file>`Evidence Gateway reference	Experimental
Evidence relying-party client profile `client-profile.json` `*.profile.json`	Operator	`apiVersion: id.registrystack.org/formats/evidence/client-profile/v1` `kind: EvidenceClientProfile`	`https://id.registrystack.org/schemas/evidence/client-profile/client-profile.v1.schema.json`Source copy: `products/evidence/generated/client-profile/client-profile.schema.json`	`evidencectl check --file <file>`Evidence Gateway reference	Promised
Evidence source import resolution file `source-resolutions.json` `*.resolutions.json`	Operator	`apiVersion: id.registrystack.org/formats/evidence/source-resolution/v1alpha1` `kind: EvidenceSourceResolution`	`https://id.registrystack.org/schemas/evidence/source-resolution/source-resolution.v1alpha1.schema.json`Source copy: `crates/registry-evidencectl/schemas/authoring/source-resolution.schema.json`	`evidencectl check --file <file>`Evidence Gateway reference	Unpromised

Base Registry Engine

Explained in Base Registry Engine configuration reference.

Format and files	Audience	Header	Schema `$id`	Check command	Stability
Registry project `registry.yaml`	Authored	`apiVersion: id.registrystack.org/formats/breg/project/v1alpha1` `kind: BRegProject`	`https://id.registrystack.org/schemas/breg/project/project.v1alpha1.schema.json`Source copy: `products/breg/generated/authoring/registry-project.schema.json`	`bregctl check <project>`Base Registry Engine reference	Promised
Registry module `modules/*/module.yaml`	Authored	`apiVersion: id.registrystack.org/formats/breg/module/v1alpha1` `kind: BRegModule`	`https://id.registrystack.org/schemas/breg/module/module.v1alpha1.schema.json`Source copy: `products/breg/generated/authoring/registry-module.schema.json`	`bregctl check <project>`Base Registry Engine reference	Promised
Base Registry Engine runtime configuration `runtime.yaml` `runtime-test.yaml` `runtime.example.yaml`	Operator	`apiVersion: id.registrystack.org/formats/breg/runtime/v1alpha1` `kind: BRegRuntimeConfig`	`https://id.registrystack.org/schemas/breg/runtime/runtime.v1alpha1.schema.json`Source copy: `products/breg/generated/runtime/runtime.schema.json`	`bregctl check <project> --runtime-config <file>`Base Registry Engine reference	Promised
Citizen MCP gateway runtime configuration `runtime.yaml`	Operator	`apiVersion: id.registrystack.org/formats/breg/mcp-runtime/v1alpha1` `kind: BRegMcpRuntimeConfig`	`https://id.registrystack.org/schemas/breg/mcp-runtime/mcp-runtime.v1alpha1.schema.json`Source copy: `products/breg/generated/mcp-runtime/mcp-runtime.schema.json`	`breg-mcp --runtime-config <file> check`Base Registry Engine reference	Experimental
Citizen review page runtime configuration `runtime.yaml`	Operator	`apiVersion: id.registrystack.org/formats/breg/review-runtime/v1alpha1` `kind: BRegReviewRuntimeConfig`	`https://id.registrystack.org/schemas/breg/review-runtime/review-runtime.v1alpha1.schema.json`Source copy: `products/breg/generated/review-runtime/review-runtime.schema.json`	`breg-review --runtime-config <file> check`Base Registry Engine reference	Experimental
Acceptance journeys `tests/journeys.yaml`	Authored	`apiVersion: id.registrystack.org/formats/breg/journeys/v1` `kind: BRegJourneys`	`https://id.registrystack.org/schemas/breg/journeys/journeys.v1.schema.json`Source copy: `products/breg/generated/tools/journeys.v1.schema.json`	`bregctl check <project> --file <file>`Base Registry Engine reference	Unpromised
Schema test credentials `credentials.yaml`	Operator	`apiVersion: id.registrystack.org/formats/breg/schema-test-credentials/v1` `kind: BRegSchemaTestCredentials`	`https://id.registrystack.org/schemas/breg/schema-test-credentials/schema-test-credentials.v1.schema.json`Source copy: `products/breg/generated/tools/schema-test-credentials.v1.schema.json`	`bregctl check --file <file>`Base Registry Engine reference	Unpromised
PublicSchema model selection `model/selection.yaml` `publicschema/starters/*.yaml`	Authored	`apiVersion: id.registrystack.org/formats/breg/model-selection/v1alpha1` `kind: BRegModelSelection`	`https://id.registrystack.org/schemas/breg/model-selection/model-selection.v1alpha1.schema.json`Source copy: `products/breg/generated/tools/model-selection.v1alpha1.schema.json`	`bregctl check --file <file>`Base Registry Engine reference	Unpromised
Development clients `dev-clients.yaml`	Operator	`apiVersion: id.registrystack.org/formats/breg/dev-clients/v1alpha1` `kind: BRegDevClients`	`https://id.registrystack.org/schemas/breg/dev-clients/dev-clients.v1alpha1.schema.json`Source copy: `products/breg/generated/tools/dev-clients.v1alpha1.schema.json`	`bregctl check --file <file>`Base Registry Engine reference	Unpromised
Example scenarios `examples/scenarios.json`	Authored	`apiVersion: id.registrystack.org/formats/breg/example-scenarios/v1alpha1` `kind: BRegExampleScenarios`	`https://id.registrystack.org/schemas/breg/example-scenarios/example-scenarios.v1alpha1.schema.json`Source copy: `products/breg/generated/tools/example-scenarios.v1alpha1.schema.json`	`bregctl check --file <file>`Base Registry Engine reference	Unpromised
Reviewed migration descriptor `modules//migrations//descriptor.json`	Operator	`apiVersion: id.registrystack.org/formats/breg/migration-descriptor/v1alpha1` `kind: BRegMigrationDescriptor`	`https://id.registrystack.org/schemas/breg/migration-descriptor/migration-descriptor.v1alpha1.schema.json`Source copy: `products/breg/generated/tools/migration-descriptor.v1alpha1.schema.json`	`bregctl check --file <file>`Base Registry Engine reference	Unpromised
External backup binding `*-binding.json`	Operator	`apiVersion: id.registrystack.org/formats/breg/backup-binding/v1alpha1` `kind: BRegBackupBinding`	`https://id.registrystack.org/schemas/breg/backup-binding/backup-binding.v1alpha1.schema.json`Source copy: `products/breg/generated/tools/backup-binding.v1alpha1.schema.json`	`bregctl check --file <file>`Base Registry Engine reference	Unpromised
LinkML schema read by bregctl init --from `*.linkml.yaml`	Authored	External formatNo Registry Stack header	None	None	Promised

Registry Casework

Explained in Author a Casework policy and Deploy Registry Casework.

Format and files	Audience	Header	Schema `$id`	Check command	Stability
Casework project `casework.yaml`	Authored	`apiVersion: id.registrystack.org/formats/casework/project/v1alpha1` `kind: CaseworkProject`	`https://id.registrystack.org/schemas/casework/project/project.v1alpha1.schema.json`Source copy: `products/casework/generated/project/project.schema.json`	`caseworkctl check <project>`Registry Casework reference	Promised
Casework runtime configuration `runtime.yaml` `runtime.example.yaml`	Operator	`apiVersion: id.registrystack.org/formats/casework/runtime/v1alpha1` `kind: CaseworkRuntimeConfig`	`https://id.registrystack.org/schemas/casework/runtime/runtime.v1alpha1.schema.json`Source copy: `products/casework/generated/runtime/runtime.schema.json`	`caseworkctl check <project> --runtime-config <file>`Registry Casework reference	Promised
Casework fixture `fixtures/.yaml` `fixtures/.yml`	Authored	`apiVersion: id.registrystack.org/formats/casework/fixture/v1alpha1` `kind: CaseworkFixture`	`https://id.registrystack.org/schemas/casework/fixture/fixture.v1alpha1.schema.json`Source copy: `products/casework/generated/fixture/fixture.schema.json`	`caseworkctl check <project>`Registry Casework reference	Unpromised
Casework clock simulation `simulations/.yaml` `simulations/.yml`	Authored	`apiVersion: id.registrystack.org/formats/casework/simulation/v1alpha1` `kind: CaseworkSimulation`	`https://id.registrystack.org/schemas/casework/simulation/simulation.v1alpha1.schema.json`Source copy: `products/casework/generated/simulation/simulation.schema.json`	`caseworkctl check <project>`Registry Casework reference	Unpromised
Casework holiday set `simulations/holiday-sets/.yaml` `simulations/holiday-sets/.yml`	Authored	`apiVersion: id.registrystack.org/formats/casework/holiday-set/v1alpha1` `kind: CaseworkHolidaySet`	`https://id.registrystack.org/schemas/casework/holiday-set/holiday-set.v1alpha1.schema.json`Source copy: `products/casework/generated/holiday-set/holiday-set.schema.json`	`caseworkctl check <project>`Registry Casework reference	Unpromised
Casework development clients `dev-clients.yaml`	Operator	`apiVersion: id.registrystack.org/formats/casework/dev-clients/v1alpha1` `kind: CaseworkDevClients`	`https://id.registrystack.org/schemas/casework/dev-clients/dev-clients.v1alpha1.schema.json`Source copy: `products/casework/generated/dev-clients/dev-clients.schema.json`	`caseworkctl check <project>`Registry Casework reference	Unpromised

Registry Scheduling

Explained in Registry Scheduling configuration reference and Registry Scheduling API.

Format and files	Audience	Header	Schema `$id`	Check command	Stability
Scheduling project `scheduling.yaml`	Authored	`apiVersion: id.registrystack.org/formats/scheduling/project/v1alpha1` `kind: SchedulingProject`	`https://id.registrystack.org/schemas/scheduling/project/project.v1alpha1.schema.json`Source copy: `products/scheduling/generated/project/project.schema.json`	`schedulingctl check <project>`Registry Scheduling reference	Experimental
Scheduling supply records `records.yaml`	Authored	`apiVersion: id.registrystack.org/formats/scheduling/records/v1alpha1` `kind: SchedulingRecords`	`https://id.registrystack.org/schemas/scheduling/records/records.v1alpha1.schema.json`Source copy: `products/scheduling/generated/records/records.schema.json`	`schedulingctl check <project>`Registry Scheduling reference	Experimental
Scheduling fixture `fixtures/.yaml` `fixtures/.yml`	Authored	`apiVersion: id.registrystack.org/formats/scheduling/fixture/v1alpha1` `kind: SchedulingFixture`	`https://id.registrystack.org/schemas/scheduling/fixture/fixture.v1alpha1.schema.json`Source copy: `products/scheduling/generated/fixture/fixture.schema.json`	`schedulingctl check <project>`Registry Scheduling reference	Unpromised
Scheduling runtime configuration `runtime.yaml` `runtime.example.yaml`	Operator	`apiVersion: id.registrystack.org/formats/scheduling/runtime/v1alpha1` `kind: SchedulingRuntimeConfig`	`https://id.registrystack.org/schemas/scheduling/runtime/runtime.v1alpha1.schema.json`Source copy: `products/scheduling/generated/runtime/runtime.schema.json`	`schedulingctl check <project> --runtime-config <file>`Registry Scheduling reference	Experimental

Registry Render

Explained in Render your first document and Run Registry Render in serve mode.

Format and files	Audience	Header	Schema `$id`	Check command	Stability
Render bundle manifest `manifest.yaml`	Authored	`apiVersion: id.registrystack.org/formats/render/bundle/v1alpha1` `kind: RenderBundle`	`https://id.registrystack.org/schemas/render/bundle/bundle.v1alpha1.schema.json`Source copy: `products/render/schemas/bundle.schema.json`	`registry-render check --bundle <project>`Registry Render reference	Experimental
Render label catalogue `labels/*.yaml`	Authored	`apiVersion: id.registrystack.org/formats/render/labels/v1alpha1` `kind: RenderLabels`	`https://id.registrystack.org/schemas/render/labels/labels.v1alpha1.schema.json`Source copy: `products/render/schemas/labels.schema.json`	`registry-render check --bundle <project>`Registry Render reference	Experimental
Render runtime configuration `runtime.yaml`	Operator	`apiVersion: id.registrystack.org/formats/render/runtime/v1alpha1` `kind: RenderRuntimeConfig`	`https://id.registrystack.org/schemas/render/runtime/runtime.v1alpha1.schema.json`Source copy: `products/render/schemas/runtime.schema.json`	`registry-render check --runtime-config <file>`Registry Render reference	Experimental
Render document data schema `schemas/*.schema.json`	Authored	External formatNo Registry Stack header	None	None	Experimental

Registry Messaging

Explained in Author a Messaging package and Deploy Registry Messaging.

Format and files	Audience	Header	Schema `$id`	Check command	Stability
Messaging project `messaging.yaml`	Authored	`apiVersion: id.registrystack.org/formats/messaging/project/v1alpha1` `kind: MessagingProject`	`https://id.registrystack.org/schemas/messaging/project/project.v1alpha1.schema.json`Source copy: `products/messaging/generated/authoring/project.schema.json`	`messagingctl check --project <project>`Registry Messaging reference	Experimental
Messaging template version `templates///template.yaml`	Authored	`apiVersion: id.registrystack.org/formats/messaging/template/v1alpha1` `kind: MessagingTemplate`	`https://id.registrystack.org/schemas/messaging/template/template.v1alpha1.schema.json`Source copy: `products/messaging/generated/authoring/template.schema.json`	`messagingctl check --project <project>`Registry Messaging reference	Experimental
Messaging HTTP provider package `providers/*/provider.yaml`	Authored	`apiVersion: id.registrystack.org/formats/messaging/provider/v1alpha1` `kind: MessagingProvider`	`https://id.registrystack.org/schemas/messaging/provider/provider.v1alpha1.schema.json`Source copy: `products/messaging/generated/authoring/provider.schema.json`	`messagingctl check --project <project>`Registry Messaging reference	Experimental
Messaging runtime configuration `runtime.yaml` `runtime.example.yaml`	Operator	`apiVersion: id.registrystack.org/formats/messaging/runtime/v1alpha1` `kind: MessagingRuntimeConfig`	`https://id.registrystack.org/schemas/messaging/runtime/runtime.v1alpha1.schema.json`Source copy: `products/messaging/generated/runtime/runtime.schema.json`	`messagingctl check --project <project> --runtime-config <file>`Registry Messaging reference	Experimental
Messaging template data schema `templates///schema.json`	Authored	External formatNo Registry Stack header	None	None	Experimental

Registry Discovery

Explained in Package and run a Registry Discovery index.

Format and files	Audience	Header	Schema `$id`	Check command	Stability
Discovery approved origins `origins.yaml`	Authored	`apiVersion: id.registrystack.org/formats/discovery/origins/v1alpha1` `kind: DiscoveryOrigins`	`https://id.registrystack.org/schemas/discovery/origins/origins.v1alpha1.schema.json`Source copy: `products/discovery/schemas/origins.schema.json`	`discoveryctl check --project <project>`Registry Discovery reference	Promised
Discovery Evidence mapping `mappings/*.yaml`	Authored	`apiVersion: id.registrystack.org/formats/discovery/evidence-mapping/v1alpha1` `kind: DiscoveryEvidenceMapping`	`https://id.registrystack.org/schemas/discovery/evidence-mapping/evidence-mapping.v1alpha1.schema.json`Source copy: `products/discovery/schemas/evidence-mapping.schema.json`	`discoveryctl check --project <project>`Registry Discovery reference	Promised
Discovery runtime configuration `runtime.yaml`	Operator	`apiVersion: id.registrystack.org/formats/discovery/runtime/v1alpha1` `kind: DiscoveryRuntimeConfig`	`https://id.registrystack.org/schemas/discovery/runtime/runtime.v1alpha1.schema.json`Source copy: `products/discovery/schemas/runtime.schema.json`	`discoveryctl check --runtime-config <file>`Registry Discovery reference	Promised

Registry Manifest

Explained in Registry Manifest portable metadata data model.

Format and files	Audience	Header	Schema `$id`	Check command	Stability
Registry Manifest metadata document `*.metadata.yaml` `metadata.yaml`	Authored	Exchange modelNo Registry Stack header	`https://id.registrystack.org/schemas/manifest/metadata/metadata.v1.schema.json`Source copy: `products/manifest/schemas/metadata.schema.json`	`registry-manifest validate <file>`Registry Manifest reference	Promised
Registry Manifest profile descriptor `profile.yaml`	Authored	Exchange modelNo Registry Stack header	`https://id.registrystack.org/schemas/manifest/profile/profile.v1.schema.json`Source copy: `products/manifest/schemas/profile.schema.json`	`registry-manifest validate-profiles <directory>`Registry Manifest reference	Promised

Registry Platform

Format and files	Audience	Header	Schema `$id`	Check command	Stability
Task-grant operator connection file `task-connection.yaml`	Operator	`apiVersion: id.registrystack.org/formats/platform/task-connection/v1alpha1` `kind: PlatformTaskConnection`	`https://id.registrystack.org/schemas/platform/task-connection/task-connection.v1alpha1.schema.json`Source copy: `products/platform/schemas/task-connection.schema.json`	`evidencectl dev check <file>`Registry Platform reference	Unpromised
ThunderID declarative resources `*.thunderid.yaml`	Authored	External formatNo Registry Stack header	None	None	Unpromised

Base Registry Engine configuration reference for every BReg key.
Evidence Gateway configuration reference for every Evidence Gateway key.
Registry Scheduling configuration reference for every Scheduling key.
Environment variable reference for fixed variables and secret references.
API stability and versioning for what a release may change.