Curated known-registries list with pinned identity

[MattDHill]

Start9 publishes a manifest of alternative registries at marketplace.start9.com, pinning the name and icon each one is expected to present. Users pick from that list instead of only typing a URL, and the pin is what StartOS displays.

The manifest

projects/brochure-marketplace/well-known/startos/registries.json, copied to .well-known by an angular.json assets entry — the deploy rsyncs with --delete, so it has to come out of the build. It ships empty; nothing is listed until Start9 populates it.

Two readers, independently: the brochure fetches it same-origin, and StartOS fetches it through a new marketplace.known-registries RPC. Going through the backend keeps the request on the server's connection rather than adding a third-party request from the user's browser, and avoids a CORS header on a prod nginx none of us can change from here. Recorded as a coupled change in the root AGENTS.md, along with the wrinkle that the site answers an unknown path with index.html and a 200, so a stale path fails as a JSON parse error rather than a 404.

Identity pinning

registries$ resolves each entry through resolveIdentity rather than the name a registry reports. That closes a hole that exists today: updateRegistryName writes whatever registry.info returns straight into ui.registries, so a custom registry could label itself "Start9 Registry" and sit in the picker next to the real one. A live name colliding with a pinned one now renders as the host instead.

identityMatches gates the other direction — adding a listed registry whose live name or icon has drifted from the pin is refused. Icons compare as decoded bytes, since DataUrl formatting isn't stable enough for string equality. No registry currently sets an icon, so the icon half only engages once one does.

Start9's own five registries carry compiled-in pins (defaultIdentities) so the protection holds offline and on first boot, and so the manifest can stay purely additive.

Add dialog

"Add" now opens a dialog with two sections rather than a bare URL prompt: a select over the curated list (icon, name, URL), and the custom URL field. It carries a tuiNotification saying Start9 neither operates these registries nor supports their services.

That caveat previously fired as a dialog on every switch to a non-default registry, which is now removed. Worth a look before merging: that dialog was also the only warning for Community, Beta and Alpha, and none of those reach the new modal the way a listed or custom registry does — Community ships pre-installed and can't be deleted, so it is never "added". Community loses its "packaged by community members, contact the package developer" message, and Alpha/Beta lose "expected to contain bugs, could damage your system", which the new banner does not say since it is about operation and support rather than stability. Easy to keep registryWarning for just those three if you'd rather.

Drive-by

Three components style tui-notification — Taiga 4's element form, which matches nothing against v5's <div tuiNotification> host directive. All three were dead rules, which is why a dialog's banner sits flush against whatever follows it. One global rule in shared.scss replaces the two that were only about spacing.

Still broken and left alone: routes/metrics/time.component.ts has the same dead selector, and there it isn't cosmetic — the :host-context(tui-root._mobile) rule meant to swap the banner for an icon on mobile has never fired. Page component with visible mobile behavior, so it wants its own change.

Bindings

KnownRegistry.ts and its index.ts line are hand-written to match what ts-rs would emit. make start-core-ts-bindings does not fit on the machine this was written on, so Generated Artifacts is the first thing to compile marketplace.rs at all — if the Rust or the binding is wrong, that job is where it shows.

Not included

• The publish-time drift check — a Start9-side job that re-fetches each listed registry and drops one whose identity moved. Ops, not repo code, and it needs a decision about where it runs. Without it the client-side refusal is the only guard, and a legitimate rename silently makes an entry unaddable until someone updates the manifest.
• Signing the manifest. It is served from the same VPS as start9.com and docs.start9.com, so a compromise there could re-pin identities. registry/signer.rs already has the primitives; it needs a key-management decision.

Verification

npm run check across every project, check-i18n (all five dictionaries), web-format-check, start-core-format-check, and AOT builds of ui and brochure — the builds being the only thing that type-checks templates under strictTemplates. The Rust is unbuilt; see above.

🤖 Generated with Claude Code