Astrid Station

This repository is the standalone, content-only source for one Astrid Station. It is an append-only publication record and lifecycle log; it is not part of the Astrid runtime or kernel. The runtime consumes a signed Pages generation after a client verifies it against this Station's trust root.

The repository contains no Rust crate, protocol implementation, signing tool, root private key, role key, or official trust root. The protocol and tool live in the separately reviewed station-tools repository; private signing material remains in an offline ceremony. The public Station identity is astrid, the tool source is astrid-runtime/station-tools, and the Pages base is https://astrid-runtime.github.io/station/v1, and the release base is https://github.com/astrid-runtime/station/releases. The reviewed tool commit is 56dce3ca2c2b69918c05e573592cc3274297f3ec. The root fingerprint, role versions, and expiries remain explicit REPLACE_* placeholders. Until every remaining placeholder is replaced and the required human/environment controls are configured, Actions fail closed and no deployment is authorized.

Source layout

Path	Purpose
records/	Immutable station-v1 publication records. A (station_id, namespace, name, version) coordinate is write-once.
events/	Hash-chained station-event-v1 lifecycle and namespace-transfer envelopes.
namespaces/	Typed namespace ownership/source claims.
artifacts/blake3/	Mandatory Pages-owned capsule bytes at their canonical content-addressed paths.
config/	Public Station routing and trust configuration only.
pages/	Pages source scaffold. Generated v1/ output is deployment-only and is not committed.
scripts/	Dependency-free local structural checks. The pinned Station tool remains authoritative for typed validation and TUF.
docs/	Station operations, wire/conformance contract, and layout guidance.

The reserved content roots are intentionally data-only: records/, events/, and namespaces/ may contain typed JSON entries only, while artifacts/ may contain only canonical .capsule objects. Their contributor guidance lives in docs/layout/, so the pinned generator never mistakes prose or an unrelated binary for Station content.

Copy config/station.toml.example to config/station.toml only as part of the approved setup. Complete the offline ceremony before adding the signed public config/trust-root.json; never put private material in GitHub or Actions. station.json.example documents the root Station identity expected by the repository tool; it is not a deployable identity.

Local checks

Run the local checks from this directory:

python3 scripts/lint_station_repository.py
python3 scripts/station_repository_validate.py --root . --json
python3 -m unittest discover -s tests -p 'test_*.py'

These checks intentionally pass on the empty scaffold without trust metadata. The publish workflow additionally clones astrid-station-tool at exact commit 56dce3ca2c2b69918c05e573592cc3274297f3ec, builds it with pinned Rust 1.88.0, and requires its validate, generate, acquire-previous, and sign-pages operations. A generated _tuf-input/ tree is unsigned staging data and is never a Pages deployment. After the first deployment, signing always authenticates and exports the deployed generation and supplies it with --previous. The only first-deployment exception is an explicit manual bootstrap=true dispatch with role versions set to one and authenticated proof that neither Pages nor a prior github-pages deployment exists. Pages is staged only after real threshold signatures and independent TUF verification succeed.

Before launch

Replace every remaining placeholder in config/station.toml and both Station workflows. Protect main, require the validation and TUF checks, establish the tuf-signing and github-pages reviewer environments, and record the offline root ceremony outside this repository. A public remote may host this inactive scaffold, but do not enable deployment, claim activation, mint a root in CI, or bypass the offline trust/key ceremony blockers.

Configure merge protection with the base-owned required workflows .github/workflows/validate-station-pr.yml and .github/workflows/check-dco.yml, not a candidate-supplied lookalike status name. Both use pull_request_target with read-only contents permission, check out the immutable base SHA, and treat the explicit PR head SHA only as inert Git/archive input. They never execute candidate scripts, workflows, or native code.

Before the trust ceremony, the protected PR workflow keeps STATION_ACTIVATED: false. This scaffold mode permits documentation and non-authority governance work while rejecting activated configuration, public trust material, publication content, and any resolved root/version/expiry/key placeholder. Activated mode requires the exact committed configuration and trust-root bindings. An ordinary content PR cannot change workflows, CODEOWNERS, the validator, DCO checker, repository linter, contribution policy, or PR template. Those authority surfaces—and the activation switch—require an explicit audited branch-rule maintenance operation followed by independent verification and restoration of protection.

See docs/OPERATIONS.md for the runbook and docs/CONFORMANCE.md for the Station wire contract.

License

Astrid Station is distributed under either the MIT License or the Apache License, Version 2.0, at your option. See LICENSE-MIT and LICENSE-APACHE.