Reset Solmara around authority-owned Relay and Evidence

[jeremi]

Summary

• reset Solmara around six independently configured, signed, and audited authority-owned Evidence cells
• replace Relay V1 and Postgres-backed lab paths with five governed Relay V2 projects over authority-published SQLite sources
• preserve all 11 operational requirement IDs, evidence-type IDs, concept IDs, purpose IDs, and programme outcomes
• route the programme by authority, verify each assertion against that authority's JWKS, and expose only safe issuer/source presentation
• add deterministic immutable-extract and live-Relay lifecycle proofs
• rebuild local and Coolify deployment around shared Mint, isolated Transit signers, recoverable authority volumes, digest-pinned images, and optional eSignet login

Release prerequisites

The reset originally targeted Registry Stack v0.19.0. Implementation proved that v0.19.0 Mint could not issue Relay-compatible scoped access tokens and Evidence could not truthfully model Relay V2's declared unresolved response. Those product prerequisites shipped in Registry Stack v0.20.1, now pinned here by exact source, binary checksums, and Relay OCI digest.

The separate esignet-relay-authenticator v0.2.0 release is also pinned by exact JAR SHA-256.

Architecture

• CRA: immutable birth extract plus Relay death and civil-link lookups
• NIA: immutable population extract plus a distinct Relay lookup for eSignet
• SRO: immutable poverty extract
• MoSD Programme MIS: Relay enrolment lookup
• SIPF: Relay pension-payment and survivor-case lookups
• NAgDI: Relay voucher and livestock-movement lookups
• Programme application: composes independently signed authority assertions and owns cross-authority decisions

Generated databases, packages, private keys, secrets, audit files, and runtime bindings remain untracked.

Verification

Passed from a clean checkout at this revision:

• Registry Stack pin and image checks
• all five Relay V2 check --production, generate, test, and package gates
• all six Evidence configuration checks and all 11 requirement fixtures
• lint, Svelte checks, 20 publisher tests, 28 scenario tests, 158 cross-product/security tests, 143 Portal tests, and 61 Home tests
• local Compose and optional eSignet Compose validation
• programme acceptance for child benefit, pension/survivor, voucher, livestock, and generic denial paths
• live lifecycle proof for mutable MoSD consultation and immutable SRO extract rebinding
• Portal live E2E: 8 passed
• Home live E2E: 44 passed, 6 intentionally skipped by live-mode selection
• real eSignet browser journey through OTP, Mint private-key JWT, NIA Relay V2, consent, token/UserInfo, and Portal redirect

Rollout

The PR includes side-by-side Coolify provisioning, signer isolation, fixed authority volumes, retained superseded volumes, digest-manifest handoff, rollout checks, and recovery documentation. Hosted image publication and live Coolify cutover evidence will be completed before this draft is marked ready.