authoring registry.yaml

The authoring registry describes one Tool, Tool Version, or Flow workspace. It never reads an execution Job registry or writes into an execution directory. Build, publish, and register each have an independent confirmation field and result record.

Complete template

This is the approved JSON-compatible YAML template. kind is one of tool, tool_version, or flow. A Flow has no local image build, but still receives local spec checks and later registration verification.

{
  "schema_version": "1.0",
  "knowledge": {
    "source": "https://www.bioline.cloud/ai/commandLineAndFkit/",
    "language": "ch",
    "document_ids": [],
    "retrieved_at": "",
    "skill_fallback_allowed": false
  },
  "workflow": {
    "lane": "authoring",
    "kind": "tool",
    "objective": "",
    "slug": "",
    "phase": "bootstrap",
    "status": "active"
  },
  "authoring": {
    "workspace": "/data/authoring/<slug>",
    "isolation": {
      "role_label": "openclaw.role=authoring",
      "slug_label": "openclaw.slug=<slug>",
      "kind_label": "openclaw.kind=tool|tool_version|flow",
      "network_allowed_for_build": true,
      "downstream_container_reuse": false
    },
    "source": {"reference": "", "name": "", "version": null, "existing_tool_id": null, "existing_version_id": null},
    "draft": {
      "artifacts": {"config": null, "summary": null, "flow_spec": null},
      "image": {"original_ref": "", "registry": "dockerhub", "proxy": null, "pull_ref": "", "fixed_tag": "", "digest": null},
      "resources": {"cpu": "", "memory": "", "disk": null, "basis": "estimated", "source_url": "", "conditions": ""},
      "pull_ledger": {"task_id": "<slug>-<timestamp>-<nonce>", "preexisting": false, "pre_image_id": null, "post_image_id": null, "pulled_at": "", "upload_verified": false, "cleanup": {"eligible": false, "attempted": false, "removed": false, "reason": "", "at": ""}},
      "baseline": {"verified": false, "reference": "", "existing_tool_id": null, "versions": [], "selected_version": null, "next_version": null, "image": "", "verified_at": ""}
    },
    "interfaces": {"inputs": [], "outputs": [], "parameters": [], "resources": {}},
    "validation": {"checks": [], "static_passed": false, "validated_at": "", "evidence": {}},
    "confirmations": {"build": false, "publish": false, "register": false},
    "publish": {"result_file": "result.json", "bioline_id": null, "version_id": null, "name_version": null, "keyword": null},
    "register": {"config_verified": false, "summary_verified": false, "discoverability_verified": false, "flow_inspect_verified": false},
    "handoff": {"discoverable": false, "kind": null, "bioline_id": null, "version_id": null, "keyword": null, "verified_at": ""}
  },
  "document_gap": {
    "detected": false,
    "topic": "",
    "attempted_document_ids": [],
    "missing_information": [],
    "blocking_reason": ""
  }
}

Fields and confirmations

draft.artifacts records separate config, summary, and flow_spec paths; filenames never select an artifact type. A new Tool requires config, summary, and image metadata; a Tool Version requires only config and summary and inherits the baseline image; a Flow requires only a FlowSpec. Closed image/resource fields pin a fixed tag, and pull_ledger records image identity before and after build pull, upload verification, and safe cleanup. draft.baseline carries reuse evidence for a Tool Version only: verified, reference, existing_tool_id, versions, selected_version, next_version, image (fixed to inherited-from-baseline), and verified_at. validation stores static checks, time, and evidence; it does not run a real analysis. publish stores real fkit IDs and NAME:VERSION; register stores exact read-back results; handoff is the minimal factual record passed to execution.

The phase guards are hard rules: built requires confirmations.build: true; published and later phases require confirmations.publish: true; registered and later phases require confirmations.register: true. tested is entered only after static validation passes, and a Tool Version additionally requires draft.baseline.verified: true from built onward. Tool config must contain a stable command; Tool Version source resolution is exact; Flow validation exports config and summary for each node and checks ports, required inputs, parameters, DAG, and method evidence. Tool summaries require bilingual top-level sections and lane front matter; downstream summaries declare analysis_lane: downstream and fixed_command: false, with empty config command fields. An unconfirmed action cannot be bypassed by a retry or a script flag.

Isolation

The workspace must be under /data/authoring/<slug>/ or an explicit authoring-root override, never under the execution root. A new Tool's build confirmation pulls the fixed image and records its before/after identity; a Tool Version's build pulls no image and instead re-verifies that the exact baseline still resolves, recording the outcome in draft.baseline. Static testing does not start a container, run a smoke command, or perform a real analysis. Publish and register are confirmed separately. Tool Version publish carries config and summary inside the create request and creates only the version selected by fkit; registration issues no redundant write and only compares exact read-back exports.