feat(stelae): name the official registry's published read-only pair

[scarmuega]

Plan

Brain/txpipe plan: dolos-stelae-cloudflare-registry — this is the hand-off that plan owed #1184: the registry now exists (oci.stelae.store, stock cloudflare/serverless-registry on Workers/R2, all nine validation gates passed), so the constants it issues stop being empty.

What changed

The two-line change #1184 designed for, plus the doc lines that said "empty until the registry exists":

• OFFICIAL_REGISTRY_USER = "stelae", OFFICIAL_REGISTRY_PASSWORD = <the published pair> in src/bin/dolos/init.rs. The password is the published read-only credential — public by design (it will sit in every consumer's docs), pull-only by the registry's capability enforcement (capabilities: ["pull"]; verified as gate 7 of the deployment plan: an upload through it is refused with 401).
• Rotation note replaces the "empty until" note: rotating is a change here and nowhere else, paired with a release and comms.

A fresh dolos init now writes:

[stelae.registry]
user = "stelae"

and never a password — the binary supplies it (stele_registry_auth), exactly as #1184 pinned.

Verification

• init::tests::a_fresh_config_seeds_the_official_registry_and_no_password, a_configured_password_survives_the_round_trip, common's a_seeded_user_takes_the_compiled_in_password, the_section_names_a_user_a_token_or_nobody, two_identities_at_once_are_refused — all green (they were written to hold on the day the constants filled).
• The compiled pair against the live deployment: curl -u stelae:… https://oci.stelae.store/v2/ → 200.
• cargo +nightly fmt --all -- --check clean.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • New configurations now default to the official registry with the stelae username.
  • Registry authentication is automatically configured for supported initialization flows.

• Documentation

  • Added guidance for the published registry credential and its rotation process.
  • Generated TOML configuration continues to exclude the registry password for improved safety.

[coderabbitai]

📝 Walkthrough

Walkthrough

The official stelae registry user and password defaults are now populated in the initialization binary. Documentation describes credential rotation and confirms that generated TOML includes the user but omits the compiled password.

Changes

Official registry configuration

Layer / File(s)	Summary
Registry defaults and generated configuration src/bin/dolos/init.rs	The official registry user is now stelae. The documentation describes release-based credential rotation and password omission from generated [stelae] configuration.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• txpipe/dolos#1184: Updates the same official registry credential defaults in src/bin/dolos/init.rs.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: naming the official registry's published read-only credential pair.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/stelae-official-registry-pair

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

src/bin/dolos/init.rs (1)

820-840: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

Extend tests for the full credential contract.

This test covers fresh configuration output only. Add coverage that:

• Authenticates OFFICIAL_REGISTRY_USER with OFFICIAL_REGISTRY_PASSWORD when the file password is absent.
• Preserves an existing configured password during a configuration round trip.

The existing src/bin/dolos/common.rs:437-445 test uses "dolos-reader", so it does not directly cover the new stelae default.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/bin/dolos/init.rs` around lines 820 - 840, Extend the configuration tests
around a_fresh_config_seeds_the_official_registry_and_no_password to verify
authentication uses OFFICIAL_REGISTRY_USER and OFFICIAL_REGISTRY_PASSWORD when
the generated registry password is absent, and add a round-trip case confirming
an explicitly configured registry password is preserved. Use the existing
authentication test pattern from common.rs while covering the stelae default
credentials directly.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/bin/dolos/init.rs`:
- Around line 820-840: Extend the configuration tests around
a_fresh_config_seeds_the_official_registry_and_no_password to verify
authentication uses OFFICIAL_REGISTRY_USER and OFFICIAL_REGISTRY_PASSWORD when
the generated registry password is absent, and add a round-trip case confirming
an explicitly configured registry password is preserved. Use the existing
authentication test pattern from common.rs while covering the stelae default
credentials directly.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f53b2c26-a063-474f-b9cd-49e5c21d69e6

📥 Commits

Reviewing files that changed from the base of the PR and between 15ddb3e and 02442d9.

📒 Files selected for processing (1)

• src/bin/dolos/init.rs