Package corrected publisher registry and complete prefix registrations

Record the verified publisher image digest and track wrapper rollout separately. Register existing CORE-WP, DISCTL-WP, and REPO-WP owners and retain the outstanding instruction correction.

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a100de-2e1c-7e23-9ae9-2da0e0499411

docs/evidence/2026-10-03-publisher-registry-refresh.md

@@ -0,0 +1,47 @@
+# Publisher registry image refresh — 2026-10-03
+
+Work: RMGR-WP-0018. Deployment acceptance: RAPPCOREHUB-WP-0003-T05.
+
+The incoming 121 accepted / 2 errors report comes from the September 1 image
+`sha256:a78fa953815b7abe78afb63ce43a29da9f09f609ace9aad2aeb98a746544e849`.
+The repository already corrected identity-canon → commerce-canon in ca7dcad
+and flex-auth → access-engine in d66d474. `Containerfile` embeds the registry,
+so pushing those commits did not update the running publisher.
+
+## Verified identities
+
+| Canonical source | Forge ID | Preserved repository UUID | Observed default-branch commit |
+| --- | --- | --- | --- |
+| coulomb/commerce-canon | 46 | 8c82baea-bb40-435d-ac42-ec7a7c20dbb8 | 2e230e7d3e163d925f040d49143426a7e622aca6 |
+| coulomb/access-engine | 42 | fda8ad85-a7d7-4055-8f21-902a533e59df | 424f1e500962470bfbe6f5ac4200ce200ecdb73e |
+
+Public Forgejo metadata and the State Hub direct `/repos/<slug>` reads agree
+with the committed registry. Both sources were observed through
+`ForgejoClassificationClient.observe` on the workstation and again inside the
+built image. Exact identity checks remain enabled; both classifications parse.
+The old identity-canon API coordinate returns the commerce-canon identity.
+
+## Published artifact
+
+- Clean build source: `03869ff30493455820ca9c4b845574ffd4c59b44`.
+- Build: `make container-build IMAGE_TAG=03869ff30493455820ca9c4b845574ffd4c59b44`.
+- Published tag: `forgejo.coulomb.social/coulomb/repo-manager:03869ff30493455820ca9c4b845574ffd4c59b44`.
+- Immutable image: `forgejo.coulomb.social/coulomb/repo-manager@sha256:69d00898cfa1ff0a4b7db8cdc86d15f5f4bea4526915019d3ca82b6f5574354c`.
+- `docker push` succeeded and reported that digest.
+- Embedded registry: 123 entries, containing commerce-canon and access-engine;
+  neither retired slug remains.
+- Packaged `rmgr publisher api` starts; `/readyz` returns HTTP 200 and
+  `{"status":"ok","repository_count":123}`.
+- `make test`: 196 passed, one existing Starlette/httpx deprecation warning.
+
+## Remaining live acceptance
+
+The container smoke test verifies the packaged registry, runtime, and two
+renamed sources. It does not claim a 123/0 production scan: the dedicated
+private-source credential remains with the deployed service.
+
+rapp-core-hub must pin the digest above, deploy through its approved release
+procedure, and run `make verify-publisher`. Track the resulting 123 accepted /
+0 errors receipt under RMGR-WP-0018-T03 and RAPPCOREHUB-WP-0003-T05. Enabling
+`publisher.connectCandidate` remains the wrapper's separate step. No cluster
+resources were changed in this session.

docs/repository-classification-publisher.md

@@ -50,6 +50,26 @@ The import is a migration/bootstrap path. Normal governed registration must
 maintain the committed UUID-to-Forgejo mapping after State Hub registrar
 retirement. The publisher contract does not change.
 
+### Deliver registry corrections
+
+`Containerfile` copies the committed registry into the publisher image. A Git
+push or `rmgr sync` updates source/work-record projections; it does not refresh
+the registry in an already running publisher. After a repository rename:
+
+1. Verify the canonical Forgejo `full_name` and preserve the registrar UUID.
+2. Update the registry coordinates, commit, and build an image from that clean
+   commit with `make container-build IMAGE_TAG=<full-commit-sha>`.
+3. Verify the embedded registry and observe the renamed sources from the image,
+   then push the image and record its immutable digest.
+4. Track the deployment in the consuming wrapper (`rapp-core-hub`). Pin the new
+   digest and deploy through its approved release procedure, then run
+   `make verify-publisher` before enabling `publisher.connectCandidate`.
+
+Keep the exact identity check strict: an old Forgejo URL redirecting to a new
+repository name is evidence to update the registry, not permission to silently
+change published identity. Source correction and live rollout need separate
+completion evidence. The October 3 refresh is tracked in `RMGR-WP-0018`.
+
 ## Run
 
 Set runtime configuration through the environment: