fix(registry): copy catalog TOML files into runtime Docker image

[toadkicker]

Summary

• The registry Docker runtime stage (debian:trixie-slim) never received the crates/pap-agents/catalog TOML files from the builder stage
• The "Install Catalog Agents" button in the admin UI always failed with: "Catalog directory not found: crates/pap-agents/catalog"
• Fixes the migration checksum error caused by a previous run editing 0001_initial.sql (already reverted); added PAP_REGISTRY_RESET_DB + PAP_REGISTRY_RESET_DB_CONFIRM instructions to docker-compose comment for recovery

Changes

• apps/registry/Dockerfile: copy catalog from builder → runtime at /app/catalog; set PAP_CATALOG_PATH=/app/catalog so the server resolves it without a manual env override

Test Plan

• Rebuild Docker image: docker compose -f apps/registry/docker-compose.yml build
• Start registry: docker compose -f apps/registry/docker-compose.yml up registry
• Navigate to Settings → PAP Catalog Agents → click "Install Catalog Agents"
• Verify success response (no "Catalog directory not found" error)
• Verify agents appear in the Agents list

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR fixes a missing COPY instruction in the multi-stage Dockerfile: the crates/pap-agents/catalog TOML files were built in the builder stage but never transferred to the debian:trixie-slim runtime image, causing the "Install Catalog Agents" admin action to fail with a directory-not-found error. The fix adds the COPY --from=builder line and sets PAP_CATALOG_PATH=/app/catalog as an ENV default so both the on-demand install path (api.rs) and the startup auto-seed path (main.rs) resolve the catalog without any manual override.

Confidence Score: 5/5

Safe to merge — targeted, correct fix with no side effects.

The change is a minimal two-line addition: a COPY instruction that pulls an already-built directory from the builder stage into the correct runtime path, and a matching ENV default. The source path is verified to exist in the builder (pap-agents is copied on line 36 of the build stage), the destination matches the env var, and both server code paths that consume PAP_CATALOG_PATH will resolve correctly. No logic, security, or correctness concerns.

No files require special attention.

Important Files Changed

Filename	Overview
apps/registry/Dockerfile	Adds COPY of catalog TOML files from builder into runtime image at /app/catalog and sets PAP_CATALOG_PATH env var; source path matches builder stage layout, destination matches env var — change is correct and complete.

Sequence Diagram

sequenceDiagram
    participant B as Builder Stage
    participant R as Runtime Stage (debian:trixie-slim)
    participant S as pap-registry server

    B->>B: cargo leptos build --release
    B->>B: produces /build/crates/pap-agents/catalog/*.toml
    B->>R: COPY --from=builder /build/target/release/pap-registry
    B->>R: COPY --from=builder /build/target/site
    B->>R: COPY --from=builder /build/apps/registry/assets
    B->>R: COPY --from=builder /build/crates/pap-agents/catalog → /app/catalog (NEW)
    Note over R: ENV PAP_CATALOG_PATH=/app/catalog (NEW)

    R->>S: start /app/pap-registry
    S->>S: main.rs reads PAP_CATALOG_PATH → /app/catalog ✓ (auto-seed)
    S->>S: api.rs install_catalog_agents() → reads PAP_CATALOG_PATH → /app/catalog ✓

Loading

_{Reviews (1): Last reviewed commit: "fix(registry): copy catalog TOML files i..." | Re-trigger Greptile}

[github-actions]

Benchmark Regression Report

PAP Protocol Benchmark Regression Check
========================================
Baseline: .bench-baseline/baseline.json
Threshold: 55%

  ed25519_keypair_generation                17.1 µs  (baseline: 22.0 µs, -22.3%)  [ok]
  did_key_derivation                         1.3 µs  (baseline: 1.6 µs, -22.5%)  [ok]
  mandate_create_sign                       20.8 µs  (baseline: 26.6 µs, -21.9%)  [ok]
  mandate_chain_verify_depth3              120.3 µs  (baseline: 156.1 µs, -22.9%)  [ok]
  sd_jwt_issue_5claims                      23.9 µs  (baseline: 31.1 µs, -23.1%)  [ok]
  sd_jwt_verify_disclose_3of5               41.6 µs  (baseline: 54.2 µs, -23.1%)  [ok]
  session_open_full_lifecycle               93.0 µs  (baseline: 120.1 µs, -22.5%)  [ok]
  receipt_create_cosign                     42.6 µs  (baseline: 53.6 µs, -20.4%)  [ok]
  federation_announce_local                 51.6 µs  (baseline: 67.0 µs, -22.9%)  [ok]


P99 Tail-Latency Check
----------------------
Results: target/p99_results.json
Threshold: 50%

  session_open_full_lifecycle(p99)         103.1 µs  (baseline: 500.0 µs, -79.3%)  [ok]
  mandate_chain_verify_depth3(p99)         157.2 µs  (baseline: 480.0 µs, -67.2%)  [ok]
  receipt_create_cosign(p99)                49.8 µs  (baseline: 210.0 µs, -76.2%)  [ok]

All benchmarks within 55% of baseline.

_{Threshold: 10% regression vs baseline from main}