chore: pin Registry Stack v0.23.0

[jeremi]

Why

h2 0.4.17 in v0.23.0 clears RUSTSEC-2026-0258 / GHSA-q83h-524g-xf6h. In
0.4.15 a peer could send empty DATA frames that were accepted and queued
without limit, risking unbounded memory growth or a length-overflow panic when
bodies are not actively drained. Relay and Evidence both serve over that HTTP/2
path, so this is the reason to move now.

What this is not

I expected a mechanical re-pin. It is not. The Evidence deployment contract
gained three required fields in v0.23.0, and the six cell bundles do not load
without them. Every Evidence container crash-looped on evidence: runtime bundle initialization failed until they were authored. The evidence check
subcommand, which validates exactly as startup does, gave the real diagnostics.

service.publicOrigin

The one externally visible origin a relying party may treat as this protected
resource's identity, used by RFC 9728 discovery. It must be a canonical HTTPS
origin under assuranceProfile: production, which every Solmara cell uses.
Each cell gets its own routed host, matching the origins already published in
metadata/solmara-wave1.metadata.yaml:

https://cra-evidence.solmara.registrystack.org
https://nia-evidence.solmara.registrystack.org
https://sro-evidence.solmara.registrystack.org
https://mosd-programme-evidence.solmara.registrystack.org
https://sipf-evidence.solmara.registrystack.org
https://nagdi-evidence.solmara.registrystack.org

requirements[].handle and requirements[].concepts[].handle

The stable keys a client reads a result under, from the new progressive
Evidence client API. Requirement handles must be unique per bundle, concept
handles unique per requirement. All 11 requirements and all 16 concepts are
authored to the last segment of the identifier they name, so nothing is
invented and the mapping stays checkable. evidence/tests/test_cells.py now
asserts exactly that convention plus both uniqueness rules, written before the
YAML changed.

Rollout consequence, please read

The Evidence bundle content changed, so a deployment's already-staged runtime
no longer matches what this version stages.

• Locally the Relay runtime stager refuses with Relay runtime staging failed against a v0.22.0 package. just reset then just up is required.
  I hit this first and confirmed it is the immutability guard working, not a
  fault in the bump.
• Hosted _check_install_tree raises existing output mismatch on a
  changed staged tree, and just reset is deliberately local-only because
  hosted rollout never deletes volumes. A hosted v0.23.0 rollout cannot
  reuse the existing Evidence and Relay runtime volumes. That is your call
  and your hands: it needs a release-candidate build, Coolify digest re-pins on
  both the is_preview: false and is_preview: true rows, and a volume
  decision. Merging this PR does not move the live fleet.

Verification, all on v0.23.0 images

Every value re-verified live against the release rather than taken from notes:
relayctl asset sha256 by download, all three image digests by
docker buildx imagetools inspect, and the source commit by dereferencing the
annotated tag.

• just lint — ruff clean, every gate script passes, portal 423 files / 0 errors, home 388 files / 0 errors
• just test — 20 + 28 + 249 Python tests OK, 143 + 61 vitest tests passed
• just hosted-pin-check — public pin gate passes; the relayctl v0.23.0 asset checksum verified and the thin image built
• just relay-check — five production Relay projects pass check, generate, test, and package
• just evidence-check — six authority cells and all eleven requirement fixtures pass
• just programme-acceptance — 10/10 PASS, including the four generic-refusal cases
• just lifecycle-proof — pass
• just lifecycle-fixture-proof — stale and invalid replacement both correctly denied
• scripts/smoke.sh — pass
• node scripts/smoke-esignet-login.mjs — PASS end to end through eSignet

Note on relayctl output

v0.23.0 changes relayctl project commands to print a human-readable summary
by default instead of JSON. Both Solmara call sites, check-relay-projects.sh
and hosted-runtime-assets.py, already pass --json explicitly, so nothing
parses the changed default.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5850b6116c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Patch publicOrigin for overridden Evidence routes

When a staging or preview deployment sets the supported SOLMARA_*_EVIDENCE_PUBLIC_HOST overrides, Compose routes each cell to that alternate host (scripts/test_hosted_evidence_routes.py:141-157), but all six bundles retain their production publicOrigin; _patch_evidence_origins only rewrites Mint and Relay URLs (scripts/provision-hosted-runtime.py:615-639). RFC 9728 discovery from the staging service therefore identifies the production resource, causing discovery-aware clients to reject the resource mismatch or use production metadata. Pass the deployed Evidence origin into provisioning and rewrite service.publicOrigin, or remove the route overrides.

Useful? React with 👍 / 👎.