Split relay config validation into domain modules while preserving public entry points

[jeremi]

Migrated from: jeremi/registry-relay#141
Original author: @jeremi
Source repository: jeremi/registry-relay
Source issue: #141
Source labels: rust, agent-ready, criticality:p3
Source milestone/release intent: none
Target area/path: crates/registry-relay

Issue

Context

src/config/validate.rs is about 3,960 lines and acts as the central validation surface for many unrelated domains: deployment, trust, auth, provenance, SPD-CI, OGC, sources, entities, aggregates, spatial validation, and SQL safety checks.

The file is smaller than the largest notary modules, but it is a good relay-side refactor candidate because validation domains are naturally separable and the public entry points are already narrow.

Current public entry points to preserve:

• validate::run
• validate::run_with_source
• validate_runtime_bindings

Scope

Split src/config/validate.rs into domain-focused modules while keeping the existing public API stable.

Likely module layout:

• config/validate/mod.rs for public entry points and orchestration
• config/validate/deployment.rs
• config/validate/trust.rs
• config/validate/auth.rs
• config/validate/provenance.rs
• config/validate/spdci.rs
• config/validate/ogc.rs
• config/validate/sources.rs
• config/validate/entities.rs
• config/validate/aggregates.rs
• config/validate/spatial.rs
• config/validate/sql.rs
• optional private config/validate/common.rs for shared helpers

The exact layout can vary if a smaller grouping better matches the code.

Acceptance Criteria

• Public entry points remain the same: validate::run, validate::run_with_source, and validate_runtime_bindings.
• Validation execution order is preserved unless a deliberate order change is documented.
• Existing error codes and messages remain stable.
• Domain modules are cohesive and private unless there is an existing reason to expose them.
• Shared helpers either stay private in validate/mod.rs or move into a private common module.
• No new public API is leaked accidentally.
• No unrelated behavior changes are included.
• No unrelated dirty files are included.

Verification

Minimum expected checks:

• cargo fmt --check
• Relay config loader tests
• Entity/config validation tests, especially tests asserting stable error codes
• A broader cargo test target if practical
• just ci-preflight if practical, per repo guidance

If just ci-preflight cannot be run, document exactly why in the PR notes.

Dependencies

No hard dependency on the notary refactor sequence because this lives in registry-relay.

Soft sequencing recommendation: use the notary test-module split pattern from jeremi/registry-notary#224 if it has already landed, but do not block this issue on it.

Migration Metadata

• Migrated to the public monorepo on 2026-06-25.
• Source title, body, labels, milestone/release intent, and pre-migration discussion were preserved where available.
• Code-grounded audit note: Relay config validation remains a large module and should be split.
• Private/internal references, secrets, and obvious deployment-only details were redacted instead of copied forward.

[jeremi]

Triage decision: post-1.0 maintenance, non-blocking.

The large validation module is a real maintainability cost, but its public entry points and behavior are currently stable and tested. Moving several thousand lines immediately before 1.0 creates churn in a security-relevant configuration boundary without changing user outcomes.

Retain this as a behavior-preserving refactor after the compatibility freeze, ideally in small domain slices with unchanged error ordering and codes.

[jeremi]

Closing as not planned following the removal of Relay V1 in #716. This issue targets Relay V1 routes, configuration, dependencies, demos, or runtime internals that are no longer present. Any equivalent Relay V2 capability needs a new issue against Relay V2's current resource, operation, disclosure, access, and source-binding contracts.