feat(relay): add governed SDMX read binding

.github/scripts/ci_changes.py

@@ -25,13 +25,15 @@
         "registry-platform-ops",
         "registry-platform-pdp",
         "registry-platform-sdjwt",
+        "registry-platform-sqlite",
         "registry-platform-testing",
     ),
     "manifest": (
         "registry-manifest-cli",
         "registry-manifest-core",
     ),
     "relay": ("registry-relay",),
+    "relay-v2": ("registry-relay-v2", "registry-relayctl"),
     "evidence": (
         "registry-evidence",
         "registry-evidence-authoring",
@@ -53,6 +55,7 @@
 EVIDENCE_PACKAGES = frozenset(SHARDS["evidence"])
 PLATFORM_PACKAGES = frozenset(SHARDS["platform"])
 MANIFEST_PACKAGES = frozenset(SHARDS["manifest"])
+RELAY_V2_PACKAGES = frozenset(SHARDS["relay-v2"])
 TUTORIAL_PACKAGES = frozenset(
     package
     for shard in ("platform", "manifest", "relay", "registryctl")
@@ -398,6 +401,8 @@ def classify(
                 seeds.update(MANIFEST_PACKAGES)
             elif path.startswith("products/platform/"):
                 seeds.update(PLATFORM_PACKAGES)
+            elif path.startswith("products/relay-v2/"):
+                seeds.update(RELAY_V2_PACKAGES)
             elif path in {
                 "docs/site/src/data/generated/relay-support.json",
                 "docs/site/src/data/relay-support.yaml",
@@ -615,7 +620,7 @@ def classify(
                 {
                     "name": shard_name,
                     "packages": selected,
-                    "all_features": shard_name == "relay",
+                    "all_features": shard_name in {"relay", "relay-v2"},
                 }
             )
 
@@ -626,6 +631,7 @@ def classify(
         "platform": platform,
         "platform_hygiene": platform_hygiene,
         "relay_contracts": "registry-relay" in affected,
+        "relay_v2_contracts": bool(affected & RELAY_V2_PACKAGES),
         "evidence_contracts": bool(affected & EVIDENCE_PACKAGES),
         "project_authoring": "registryctl" in affected,
         "release_tool": release_tool,

.github/scripts/test_ci_changes.py

@@ -183,6 +183,7 @@ def test_orphan_platform_crates_and_oid4vci_fuzz_surface_are_absent(self) -> Non
                 self.assertFalse(Path("crates", crate).exists())
 
         self.assertIn("registry-platform-pdp", SHARDS["platform"])
+        self.assertIn("registry-platform-sqlite", SHARDS["platform"])
         self.assertIn("registry-platform-testing", SHARDS["platform"])
         self.assertFalse(
             Path(
@@ -213,6 +214,28 @@ def test_shards_cover_every_workspace_package_once(self) -> None:
         self.assertCountEqual(assigned, self.workspace.package_names)
         self.assertEqual(len(assigned), len(set(assigned)))
 
+    def test_relay_v2_paths_select_only_the_v2_product_contract(self) -> None:
+        outputs = classify(
+            self.workspace,
+            ("crates/registry-relay-v2/src/compiler.rs",),
+        )
+        self.assertIn("registry-relay-v2", outputs["rust_packages"])
+        self.assertIn("registry-relayctl", outputs["rust_packages"])
+        self.assertTrue(outputs["relay_v2_contracts"])
+        self.assertFalse(outputs["relay_contracts"])
+        self.assertNotIn("registryctl", outputs["rust_packages"])
+
+    def test_relay_v2_product_material_selects_runtime_and_tooling(self) -> None:
+        outputs = classify(
+            self.workspace,
+            ("products/relay-v2/contracts/security-invariants.yaml",),
+        )
+        self.assertEqual(
+            set(outputs["rust_packages"]),
+            {"registry-relay-v2", "registry-relayctl"},
+        )
+        self.assertTrue(outputs["relay_v2_contracts"])
+
     def test_example_pr_runs_only_affected_rust_shards(self) -> None:
         outputs = classify(
             self.workspace,

.github/workflows/ci.yml

@@ -44,6 +44,7 @@ jobs:
       platform: ${{ steps.filter.outputs.platform }}
       platform_hygiene: ${{ steps.filter.outputs.platform_hygiene }}
       relay_contracts: ${{ steps.filter.outputs.relay_contracts }}
+      relay_v2_contracts: ${{ steps.filter.outputs.relay_v2_contracts }}
       evidence_contracts: ${{ steps.filter.outputs.evidence_contracts }}
       project_authoring: ${{ steps.filter.outputs.project_authoring }}
       release_tool: ${{ steps.filter.outputs.release_tool }}
@@ -274,6 +275,7 @@ jobs:
           - authcommon_parsers
           - sdjwt_holder_proof
           - sdjwt_issuance
+          - sqlite_statement
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
@@ -533,6 +535,32 @@ jobs:
           cargo test --locked -p registry-relay --test api_docs
           openapi_json_can_be_moved_to_public_router_for_local_testing -- --exact
 
+  relay-v2-contracts:
+    name: Relay V2 product contracts
+    needs: changes
+    if: needs.changes.outputs.relay_v2_contracts == 'true'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        with:
+          persist-credentials: false
+          submodules: false
+
+      - name: Cache Cargo registry
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        with:
+          shared-key: workspace-registry
+          cache-targets: false
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+
+      - name: Relay V2 contract consistency
+        run: products/relay-v2/scripts/check-contracts.sh
+
+      - name: Relay V2 coequal HTTP journeys
+        run: products/relay-v2/scripts/test-http.sh
+
   rust-result:
     name: Rust workspace
     if: always()
@@ -543,6 +571,7 @@ jobs:
       - rust-tests
       - evidence-contracts
       - relay-contracts
+      - relay-v2-contracts
     runs-on: ubuntu-24.04
     env:
       RUST_JOB_RESULTS: ${{ toJSON(needs) }}

AGENTS.md

@@ -48,14 +48,22 @@ dependency runs one way only in production: no Evidence crate depends on
 | `crates/registry-mint` | Short-lived access tokens for registered clients, and the `mint` binary |
 | `crates/registry-manifest-*` | Manifest core types and CLI |
 | `crates/registry-platform-*` | Shared primitives used by the maintained runtimes and tooling |
+| `crates/registry-platform-sqlite` | Shared bounded read-only SQLite security boundary used by Relay V2 and Evidence |
 | `crates/registryctl` | Relay adopter tooling |
+| `crates/registry-relay-v2` | Contract-compiled Relay V2 runtime and the `relay` binary; additive beside legacy Relay |
+| `crates/registry-relayctl` | Relay V2 adopter tooling and the `relayctl` binary; it does not replace `registryctl` |
 | `crates/registry-evidence-oid4vci` | Wallet-facing OID4VCI delivery front end for Evidence credentials, and the `evidence-oid4vci` binary |
 | `crates/registry-language-server` | Editor language server for Relay manifests and Evidence authoring documents, linked into both adopter tools |
 | `products/` | Product-owned specs, examples, fixtures, docs (not crates) |
 | `docs/site/` | Public docs site (Astro). Has its own `AGENTS.md`; read it before touching this subtree |
 | `release/` | Release manifests, schemas, notes, validation and conformance tooling, and the release source-model proof |
 | `external/` | Notes on inputs that intentionally stay out of this tree (e.g. Crosswalk stays a pinned git dependency) |
 
+Relay V2 is developed additively under `registry-relay-v2` and
+`registry-relayctl`. It must not change the behavior or configuration contract
+of `registry-relay` or `registryctl`. Its approved contracts, coequal acceptance
+projects, and gates live under `products/relay-v2`.
+
 ## Evidence product boundary
 
 Evidence is its own minimum-disclosure assertion product, not a Relay mode.