feat: add durable addressed registry publication

backend/src/workspaces/registry.ts

@@ -17,6 +17,16 @@ import {
   type WorkspaceDescriptor,
 } from "./schema.js";
 import type { WorkspaceErrorCode, WorkspaceRegistryConfig } from "./types.js";
+import {
+  RegistryAddressedPublicationStore,
+  canonicalBootstrapRequestDigest,
+  type RegistryAddressedSnapshotV1,
+  type RegistryBootstrapAddressedRequestV1,
+  type RegistryEnsureBootstrapAddressedResultV1,
+  type RegistryPublishAddressedRequestV1,
+  type RegistryAddressedRequestV1,
+  type RegistryAddressedPublicationResultV1,
+} from "./registry-publication.js";
 
 export type { GitStatus } from "./git-repository.js";
 
@@ -116,6 +126,44 @@ export class WorkspaceRegistry {
     return join(this.repository.snapshotsPath, safeCommit(commit), `${workspacePath(id).slice("workspaces/".length)}`);
   }
 
+  /** Repository-first addressed selector. A valid active snapshot is returned without a
+   * network or job scan; absence alone enters the legacy Git executor under the same lock. */
+  async ensureBootstrapAddressed(request?: RegistryBootstrapAddressedRequestV1): Promise<RegistryEnsureBootstrapAddressedResultV1> {
+    await this.repository.ensureLayout();
+    const active = await this.tryActiveState();
+    const req = request ?? this.defaultAddressedRequest(active?.head ?? null);
+    if (active) {
+      const snapshot = this.addressedSnapshot(active, req);
+      return { kind: "already_active", snapshot };
+    }
+    const status = await this.bootstrap();
+    const next = await this.activeState();
+    const snapshot = this.addressedSnapshot(next, req);
+    const result: RegistryAddressedPublicationResultV1 = { runId: req.requestDigest.slice(0, 32), snapshot, result: status };
+    return { kind: "bootstrap_terminal", result, snapshot };
+  }
+
+  async publishAddressed(request: RegistryPublishAddressedRequestV1): Promise<RegistryAddressedPublicationResultV1> {
+    if (!request || request.requestDigest !== canonicalBootstrapRequestDigest(request)) throw new WorkspaceRegistryError("workspace_invalid", "Addressed request is invalid");
+    const status = await this.pull();
+    const active = await this.activeState();
+    const snapshot = this.addressedSnapshot(active, request);
+    return { runId: request.requestDigest.slice(0, 32), snapshot, result: status };
+  }
+
+  private defaultAddressedRequest(head: string | null): RegistryBootstrapAddressedRequestV1 {
+    const installation = { installationId: this.config.installationId, digest: createHash("sha256").update(this.config.installationId).digest("hex") };
+    const repository = { remote: this.config.remoteUrl ?? "", branch: this.config.branch, head: head ?? "", digest: createHash("sha256").update(`${this.config.remoteUrl ?? ""}:${this.config.branch}:${head ?? ""}`).digest("hex") };
+    const remote = { remote: this.config.remoteUrl ?? "", head: head ?? "", digest: repository.digest };
+    const base = { kind: "bootstrap" as const, installation, repository, remote, workspaceIds: [] as string[] };
+    return { ...base, requestDigest: canonicalBootstrapRequestDigest(base) };
+  }
+
+  private addressedSnapshot(state: ActiveState, request: RegistryAddressedRequestV1): RegistryAddressedSnapshotV1 {
+    const ids = state.revisions.map(revision => revision.id).sort();
+    return { schemaVersion: 1, commit: state.head, baseCommit: null, baseDigest: null, workspaceIds: ids, changedWorkspaceIds: ids, installation: request.installation, repository: { ...request.repository, head: state.head }, remote: { ...request.remote, head: state.head }, requestDigest: request.requestDigest };
+  }
+
   async bootstrap(): Promise<GitStatus> {
     await this.repository.ensureLayout();
     return await this.lock.run(async () => {