Transcribe the `spec` grammar and serve mint through the endpoint

[sehkone]

Transcribe the spec grammar and serve mint through the endpoint

Context

The registrar endpoint already decodes requests, authenticates callers, invokes registrar verbs, and encodes responses. Deregistration is served end to end. Mint was deliberately incomplete because requested_spec() in src/registrar/endpoint/production.rs rejected every wire spec with SpecConversionError::GrammarNotSettled before the mint verb ran.

The wire exposes spec.reload and spec.cert_group as opaque owner-controlled strings. The verb layer requires ReloadSpec { kind, target } and Option<u32> for its rendered-config safe-set comparison. Bootler’s provisioning-file grammar is settled; its owner-published wire-packing row now defines both opaque wire strings.

Scope

This issue is unblocked. The bootler provisioning-config contract published the exact wire-packing productions in core/src/provisioning_file.rs, module documentation section Wire spelling, at immutable revision 008bbb458b0b (bootler #308, merged by PR #309).

Transcribe those productions verbatim into docs/reference/registrar-wire-contract.md with their owner artifact, location, section, and immutable revision. Implement requested_spec() only from those transcribed rows; preserve component and service_name in RequestedSpec; accept exactly the recorded forms; and reject every other spelling with typed SpecConversionError variants. Then remove GrammarNotSettled and serve mint through the existing handler path.

Acceptance criteria

• Before any implementation in this issue starts, the bootler provisioning-config contract publishes an immutable wire-packing row for spec.reload and spec.cert_group. The row defines complete accepted and rejected text syntax and every canonicalization rule.
• The wire-contract reference faithfully reproduces both productions with the owner artifact, exact location, section, and immutable revision; it has no unresolved item for either field.
• requested_spec() maps every accepted production to the exact RequestedSpec required by the verb layer and accepts no unrecorded spelling.
• Conversion tests cover every accepted production, every rejection and canonicalization class, target-required and target-forbidden cases, omitted certificate group, 0 and u32::MAX where admitted, and out-of-range numeric input.
• Invalid grammar remains on the existing zero-byte, clean-close refusal path. A valid socket mint reaches the verb layer under the transport-authenticated CallerIdentity, returns an encoded mint outcome with a decoded ca_anchor, and observes a rewritten bootroot/ca on the next mint.
• Conversion remains separately tested from rendered safe-set comparison, and the four operator-documentation pages, example configuration, and existing Unreleased changelog entry describe mint as served.

Constraints

• This issue must not choose, broaden, normalize, or infer wire syntax from a TOML representation. It may apply only canonicalization explicitly recorded by the immutable owner row.
• Do not change the frozen provisioning-file contract: reload is an inline table with kind and target; kind is exactly sighup, systemd, docker-restart, or none; the first three require a non-empty target and none omits it. cert_group is a bare u32, or its key is omitted.
• Do not change rendered safe-set comparison, identity derivation, registrar verbs, wire protocol, limiter, audit records, or transport behavior. Do not add a wire error identifier or widen the conversion-refusal taxonomy.
• Preserve the distinction between endpoint grammar rejection and a decoded spec outside the rendered safe set.

Out of scope

• Publishing, deciding, or changing the bootler wire-packing row.
• Changing the provisioning tool’s reload or cert_group vocabulary or file shape.
• Operations other than mint, deregistration behavior, and a broader endpoint redesign.

Test plan

• After the owner row is transcribed, add table-driven conversion tests directly from it and the required numeric and target boundaries.
• Drive valid and invalid mint requests through the endpoint integration harness, including caller identity, encoded material, CA-anchor refresh, and zero-byte clean-close refusal.
• Run targeted registrar tests, the CI rustfmt and clippy commands, ./scripts/check-docs.sh, and scripts/preflight/run-all.sh. If passwordless sudo blocks the E2E matrix, run it to that prerequisite, report passed and unrun arms in the PR, and leave the remaining Docker E2E gate to CI.

Dependencies

The old chain wording was stale rather than circular: bootler #200 was gated behind #198 and #186, and is its terminus. Both #186 and #198 are closed. The provisioning-file grammar from aicers/bootler#200 is frozen on bootler main by PR #304, merge commit 3ec391f398dd. #200 remains open only for test-observability and diagnostics follow-up (#305), which freezes the reload token vocabulary, cert_group shape, and fingerprint byte range.

The former remaining gate is now resolved by bootler #308, merged by PR #309 at immutable revision 008bbb458b0b. Its core/src/provisioning_file.rs module documentation section Wire spelling defines the packing of spec.reload and spec.cert_group into the opaque wire strings. This issue must name that exact artifact location and immutable revision and transcribe its complete productions before implementation begins.

aicers/review-protocol#218 intentionally types both values as opaque strings and is not their packing authority. The existing endpoint handler, verb layer, caller-identity plumbing, and CA-anchor read path need no further dependency.

Pointers

• src/registrar/endpoint/production.rs: requested_spec(), SpecConversionError, and ProductionHandler
• src/registrar/endpoint/production/tests.rs
• src/registrar/endpoint/protocol.rs: WireServiceSpec
• src/registrar/identity.rs: RequestedSpec; src/registrar/config.rs: ReloadSpec
• docs/reference/registrar-wire-contract.md and docs/reference/registrar-provisioning-config.md section 3.2
• docs/en/configuration.md, docs/en/operations.md, docs/ko/configuration.md, docs/ko/operations.md, agent.toml.example, and CHANGELOG.md

[sehkone]

Verification summary

• Delivery: COMPLETE — the merged code delivers what the issue asked for. (the auditor's own verdict)
• Extra changes: NO_EXTRA_CHANGES — the merged code changed nothing beyond what the issue asked for. (the auditor's own verdict)
• Defects: NO_DEFECT — the merged pull requests left no defect of their own behind. (the auditor's own verdict)

Delivery decides whether this issue is closed or reopened. Defects widens what the follow-up filing considers. Extra changes gates nothing — it is an observation for a human; the report names what went beyond the issue.

Implementing pull requests, at the merge commits this audit read:

• Serve mint through endpoint (#912) #968 — 80f81dd6cea8c95be8b35dd60561238de8d5b997 (the tree the audit read)

The full report — the assessment included verbatim — stays local, at:
~/.agentcoop/runs/aicers/bootroot/verify/OTEy/report.md

Findings this run did not file:

Finding not filed — The supplied evidence could not verify this finding.
Summary (the filing turn's statement):
The audit could not independently verify that bootler's immutable owner row was published before implementation began.
Requirement (quotation from the target issue):
Before any implementation in this issue starts, the bootler provisioning-config contract publishes an immutable wire-packing row for `spec.reload` and `spec.cert_group`.
Missing evidence (the filing turn's statement):
The supplied bootroot checkout and ten-path merged diff contain only a provenance citation, not the bootler owner artifact or evidence establishing publication timing before implementation.

Finding not filed — The supplied evidence could not verify this finding.
Summary (the filing turn's statement):
The audit could not independently verify that the local wire-contract rows faithfully reproduce the bootler owner productions verbatim.
Requirement (quotation from the target issue):
The wire-contract reference faithfully reproduces both productions with the owner artifact, exact location, section, and immutable revision; it has no unresolved item for either field.
Missing evidence (the filing turn's statement):
The supplied evidence does not include `aicers/bootler` `core/src/provisioning_file.rs` at revision `008bbb458b0b`, so the local rows cannot be compared with the owner artifact.

Finding not filed — The supplied evidence could not verify this finding.
Summary (the filing turn's statement):
The audit could not verify the historical local preflight and local Docker-matrix attempt required by the test plan.
Requirement (quotation from the target issue):
Run targeted registrar tests, the CI rustfmt and clippy commands, `./scripts/check-docs.sh`, and `scripts/preflight/run-all.sh`. If passwordless sudo blocks the E2E matrix, run it to that prerequisite, report passed and unrun arms in the PR, and leave the remaining Docker E2E gate to CI.
Missing evidence (the filing turn's statement):
The adjusted merge evidence establishes successful Rust, CI, documentation, unit/smoke, and Docker E2E gates, but supplies no local command logs or pull-request report of the required local preflight and matrix attempt.

Finding not filed — The issue specifies the property, not this means.
Summary (the filing turn's statement):
The implementation does not use a general TOML parser for the opaque wire fields.
Requirement (quotation from the target issue):
Implement `requested_spec()` only from those transcribed rows; preserve `component` and `service_name` in `RequestedSpec`; accept exactly the recorded forms; and reject every other spelling with typed `SpecConversionError` variants.
Observed (the filing turn's statement):
src/registrar/endpoint/production.rs:430

Finding not filed — The issue specifies the property, not this means.
Summary (the filing turn's statement):
The custom string decoder has no additional raw-control-character guard.
Requirement (quotation from the target issue):
This issue must not choose, broaden, normalize, or infer wire syntax from a TOML representation. It may apply only canonicalization explicitly recorded by the immutable owner row.
Observed (the filing turn's statement):
src/registrar/endpoint/production.rs:475

Finding not filed — The issue specifies the property, not this means.
Summary (the filing turn's statement):
The implementation reads the CA anchor per mint before invoking the verb instead of using another cache or ordering mechanism.
Requirement (quotation from the target issue):
Invalid grammar remains on the existing zero-byte, clean-close refusal path. A valid socket mint reaches the verb layer under the transport-authenticated `CallerIdentity`, returns an encoded mint outcome with a decoded `ca_anchor`, and observes a rewritten `bootroot/ca` on the next mint.
Observed (the filing turn's statement):
src/registrar/endpoint/production.rs:153

Finding not filed — The issue specifies the property, not this means.
Summary (the filing turn's statement):
The implementation reuses the existing handler-refusal and logging mechanism for invalid grammar.
Requirement (quotation from the target issue):
Invalid grammar remains on the existing zero-byte, clean-close refusal path. A valid socket mint reaches the verb layer under the transport-authenticated `CallerIdentity`, returns an encoded mint outcome with a decoded `ca_anchor`, and observes a rewritten `bootroot/ca` on the next mint.
Observed (the filing turn's statement):
src/registrar/endpoint/tests.rs:3046