CRUMB a card from devarno-cloud

pellets-registry: Receiver, Namespace Claims, Witnessed Transparency Log

nestr advanced 7 min read

ELI5

The registry is the post office for Pellets. Every package it accepts is written into a public, append-only ledger, and at least two independent notaries must countersign the ledger’s latest page before the post office will hand anything out. That is the design. Today the hosted post office is open, but its ledger has no pages yet and no notaries have signed.

Technical Deep Dive

Source: nestr-tools/pellets-registry cmd/registry/main.go:60-80,200-240, cmd/registry/transparency.go:20-70, internal/transparency/ (rekor_v1.go, tlog_witness.go, witnessed.go, merkle.go, note.go), internal/namespace/verify/resolvers.go:15-35, internal/receiver/handler.go:390-406, railway.toml @5807213; nestr-tools docs/decisions/2026-10-12-phase-12-launch-scope.md §8, docs/decisions/2026-10-22-early-access-design-partner-seat.md Context @b8f0585; live https://registry.nestr.tools/healthz and /metrics, read 2026-10-25.

Two modes

ModeTriggerBehaviour
witnessedPELLETS_REGISTRY_REKOR_URL setRekor v1 backend (signed hashedrekord entries, pinned log key and checkpoint origin, RFC 6962 proofs) plus a C2SP tlog-witness pool; needs the log signing key, at least 2 witness URL and key pairs, and a durable journal in production. A fail-closed start-up probe must collect at least 2 verified cosignatures on the current head, or the process refuses to start.
unwitnessed fallbackPELLETS_REGISTRY_REKOR_URL unsetloud WARN; namespace records go to a local file log, publish uses a no-op submitter; heads carry 0 cosignatures and no checkpoint note, so they are structurally distinguishable (I-7). Outside production only, PELLETS_REGISTRY_INSECURE_ALLOW_UNWITNESSED_FALLBACK=1 lets a misconfigured witnessed setup fall back instead of refusing.
sequenceDiagram
  participant P as publisher
  participant R as pellets-registry
  participant L as Rekor v1 log
  participant W as witnesses x2 or more
  participant I as installer
  P->>R: publish pellet with signature block
  R->>L: submit hashedrekord entry
  L-->>R: inclusion proof, new checkpoint
  R->>W: request cosignature on checkpoint
  W-->>R: C2SP cosignatures
  R->>R: serve only if 2 or more verified cosignatures
  I->>R: fetch pellet and proofs
  I->>I: verify inclusion against witnessed checkpoint

Live state, 2026-10-25

/healthz answered ok from Railway (server: railway-hikari). /metrics (public) reported pellets_registry_translog_tree_size 0, pellets_registry_translog_witness_cosignatures 0 and pellets_registry_translog_sth_timestamp_seconds 0. Because witnessed mode refuses to start without 2 cosignatures, a running registry at 0 cosignatures is consistent with the unwitnessed fallback, which matches the landing’s statement that the transparency log is “not switched on for the hosted registry yet”. The Rekor URL setting itself was not read (Railway env): UNVERIFIED.

Namespaces and publishing

flowchart LR
  OWN["namespace owner"] --> TXT["TXT record at _nestr-namespace.owner-domain"]
  TXT --> VER["verify ceremony, rate-limited 5 burst per 10s per IP"]
  VER --> NOR["namespace ownership record, logged"]
  NOR --> OP["operator countersigns the receipt"]
  PUB["customer publish"] -. "receiver accepts HS256 shared-key JWTs only" .-> BLOCK["no customer credential is minted: not available"]

A namespace claim by DNS TXT proof works and ends at a receipt the operator countersigns. Publishing does not: the receiver validates only HS256 tokens signed with a shared key (handler.go:394-406), nothing mints them for customers, and the publish-credential gap (N35) was cut below the launch line. The namespace list is registry-wide, not per organisation. The OIDC proof path defaults to a no-op resolver until hatch/airlock wiring (M10.4).

Key Terms

  • checkpoint → signed tree head in C2SP note format; what witnesses cosign.
  • witness → an independent party that cosigns a checkpoint after checking consistency.
  • NOR → namespace ownership record, the authority for who may sign in a namespace.
  • I-7 fallback → a stub or offline path that must WARN once and produce output distinguishable from production-grade output.

Q&A

Q: What must hold before the registry serves pellets at a log head in witnessed mode? A: At least two witness cosignatures on that head, each verified against a configured witness key. Both the namespace store and the publish receiver enforce it, and the start-up probe refuses to run without it.

Q: What did the hosted registry’s metrics show on 2026-10-25, and what does that imply? A: Tree size 0, witness cosignatures 0, STH timestamp 0. Since witnessed mode cannot start below two cosignatures, the hosted registry is almost certainly in the I-7-marked unwitnessed fallback with an empty log.

Q: How is a namespace claimed, and can a customer publish today? A: By publishing a TXT record at _nestr-namespace.<owner-domain>, passing the verify ceremony, and having the operator countersign the receipt. Customers cannot publish today: the receiver accepts only shared-key HS256 tokens that nothing issues to them.

Examples

An Early Access organisation claims @acme by TXT record on acme.com. The claim is recorded and countersigned, and it appears in the registry-wide namespace list on the dashboard. Hosting and publishing in that namespace are listed as “when shipped” in the countersigned design-partner decision.

neighbors on the map