feat(relay): publish runtime config schema

Cargo.toml

@@ -129,6 +129,7 @@ ryu-js = { version = "1.0.2" }
 secrecy = { version = "0.10" }
 serde = { version = "1", features = ["derive"] }
 serde_json = { version = "1" }
+schemars = { version = "=1.2.1" }
 serde_norway = { version = "0.9" }
 serde_path_to_error = { version = "0.1" }
 serde-saphyr = { version = "0.0.26" }

crates/registry-relay/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## Unreleased
 
+- Relay now publishes a reproducible, product-owned Draft 2020-12 schema for
+  the complete runtime configuration. `registry-relay schema --format json`
+  prints the committed artifact byte for byte, and local CI checks schema drift,
+  maintained runtime fixtures, strict nested and tagged shapes, and exact
+  bidirectional configuration-reference key paths. Schema and runtime parsing
+  now share bounded listener-address and duration string grammars, integer
+  widths have explicit JSON Schema bounds, and environment references reflect
+  their consumer-specific runtime invariants.
 - BREAKING: configuration `${VAR}` expansion now rejects environment variables
   that are unset or empty. `${VAR:-fallback}` uses its fallback for either
   state, `${VAR:-}` explicitly expands to empty, and `${VAR:?message}` reports

crates/registry-relay/Cargo.toml

@@ -76,6 +76,7 @@ tokio-util = { version = "0.7" }
 # ─── serialization / config ──────────────────────────────────────────────────
 serde = { version = "1", features = ["derive"] }
 serde_json = { version = "1" }
+schemars.workspace = true
 rhai.workspace = true
 crosswalk-functions = { workspace = true, features = ["date", "redaction"] }
 # Optional Crosswalk CEL mapping support. Disabled by default so the core VC
@@ -154,7 +155,7 @@ insta = { version = "1", features = ["json"] }
 # don't multiply build-time copies.
 zip = { version = "8", default-features = false, features = ["deflate"] }
 # Validates payloads in standards-adapter tests.
-jsonschema = { version = "0.18" }
+jsonschema = { version = "0.18", features = ["draft202012"] }
 # Ed25519 key generation for tests so they can mint fresh keypairs and
 # convert them to/from JWK without shelling out to openssl.
 ed25519-dalek = { version = "2", features = ["pkcs8", "rand_core"] }