Summary

• Makes the source system to Relay to Notary to consuming programme boundary normative across architecture, integration, disclosure, glossary, and Notary guidance.
• Replaces programme-specific eligibility examples with reusable evidence claims, while documenting the narrow source-owned decision exception.
• Reworks the DHIS2 starter into a bounded product-neutral script integration that exposes child-health evidence, plus deterministic offline fixtures for true, false, null, no-match, subject mismatch, and source failure.
• Updates generated authoring catalogs, focused registryctl tests, and the optional live-compatibility conformance profile.

Verification

Passed locally:

• cargo fmt --check
• cargo metadata --locked --format-version 1
• cargo check --locked --workspace --all-targets
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --locked --workspace
• cargo deny check
• npm test (117 tests)
• docs content, markdown, Vale, tutorial dry-run, generation, current build, all archived builds, LLM coverage, and SEO checks
• python3 -m unittest discover -s release/scripts -p test_*.py (200 tests)
• REGISTRY_RELEASE_SOURCE_MODE=monorepo release/scripts/check-release-source-model.sh
• python3 release/scripts/integration-e2-runner.py validate
• python3 release/scripts/registry-release validate release/manifests/registry-stack-beta-14.yaml
• Notary OpenAPI check and Relay OpenAPI contract check
• git diff --check

After rebasing onto beta-14, the fresh GitHub Docs job passes the complete npm run check, including content, markdown, Vale, tutorial dry-run, generation, current and archived builds, link checking, LLM coverage, and SEO.

GitHub Actions confirms the issue-specific project-authoring portability and determinism jobs pass on x86_64 Linux and aarch64 macOS. DCO, secret scan, CodeQL, Scorecard, and release tooling also pass.

Rebased onto the beta-14 release/1.0 head (817ddec6), which contains the target-base CI repairs identified in the initial run. The fresh build for 19622430 is green: 13 checks passed, 6 path-gated checks were intentionally skipped, and none failed. In particular, Docs, Rust workspace including the Relay OpenAPI baseline comparison, and the source-built Registryctl tutorial all pass.

Security review

• Authorization remains enforced before source work.
• The DHIS2 adapter performs one bounded same-origin request, validates the exact subject selector echoed by the source, and returns only declared typed evidence outputs.
• Credentials remain environment-backed and no raw DHIS2 records enter claims or public release evidence.
• true, false, null, no_match, subject mismatch, and source rejection remain distinct fail-closed semantics. Missing evidence does not become a negative fact.
• No runtime route, authentication, authorization, audit, or cryptographic behavior changes.

Because this change defines security and privacy guidance, Tier-C maintainer review and signoff remain required.

Live compatibility

No public DHIS2 server was contacted. Live compatibility remains an optional, separately governed evidence run; deterministic offline fixtures are the acceptance path.

Closes #417