diff --git a/plan/implementation-plan.md b/plan/implementation-plan.md
index e28bba1..1438965 100644
--- a/plan/implementation-plan.md
+++ b/plan/implementation-plan.md
@@ -21,7 +21,7 @@ This plan covers the implementation of all 10 repos in the CognitiveOS-Project o
 | `cli` | UI | Go | Bubble Tea TUI frontend |
 | `cognitiveos-distro` | Distribution | Shell/Docker | Alpine image builder |
 | `cgp-template` | Ecosystem | Template | .cgp skill boilerplate |
-| `registry-server` | Infrastructure | Go | .cgp package registry |
+| `registry-server` | Infrastructure | Go | .cgp notary proxy (metadata + checksum, no file hosting) |
 
 ## Dependency Graph
 
@@ -41,7 +41,7 @@ product-specs ──────────────────────
     │   │
     ├── cli ────────── depends on cognitiveosd (socket client)
     │
-    ├── registry-server ─── depends on registry-api spec
+    ├── registry-server ─── depends on registry-api spec, dependency-validation spec
     │
     └── cgp-template ─ depends on .cgp format spec
 
@@ -251,26 +251,38 @@ cognitiveos-distro ───── depends on all built binaries
 
 **Repos:** `registry-server`, `cgp-template`
 
-**Goal:** Usable package registry and developer template.
-
-| Task | Dependencies | Est. effort |
-|------|-------------|-------------|
-| `GET /v1/search` | registry-api | Medium |
-| `GET /v1/patches/{name}/{version}` | registry-api | Small |
-| `GET .../download` — .cgp binary streaming | registry-api | Medium |
-| `POST /v1/patches` — publish with auth | registry-api | Medium |
-| `POST .../unlock` — unlock code verification | registry-api | Medium |
-| SQLite metadata index | None | Medium |
-| Token-based auth | None | Medium |
-| cgp-template with sample patch | cgp-format spec | Small |
-| cgp-template README and documentation | None | Small |
+**Goal:** Usable package notary proxy and developer template.
+
+The registry is a **notary proxy** — it does not host `.cgp` files. Publishers provide a canonical `download_url` and a `sha256` checksum; the registry stores metadata and redirects clients to the download URL. This avoids file storage scaling concerns and allows publishers to host archives on their own infrastructure (GitHub Releases, S3, etc.).
+
+| Task | Dependencies | Est. effort | Status |
+|------|-------------|-------------|--------|
+| `GET /v1/search` — text search across name, description, tags | registry-api | Small | ✅ Done |
+| `GET /v1/patches/{name}` — latest version metadata | registry-api | Small | ✅ Done |
+| `GET /v1/patches/{name}/{version}` — version-specific metadata with full manifest | registry-api | Small | ✅ Done |
+| `GET /v1/patches/{name}/{version}/download` — HTTP 302 redirect to `download_url` | registry-api | Small | ✅ Done |
+| `POST /v1/patches` — JSON-only publish with `manifest`, `sha256`, `download_url` | registry-api | Medium | ✅ Done |
+| `PUT /v1/patches/{name}/{version}` — publish new version, URL validated against body | registry-api | Small | ✅ Done |
+| A1-A10 publish-time validation (manifest parse, schema, SHA-256 format, dep cycles, file refs, hardware bounds, URL reachability) | dependency-validation spec | Large | ✅ Done |
+| Scoped token auth (`publish` scope for POST/PUT, `admin` scope for status/validate) | None | Medium | ✅ Done |
+| `PATCH /v1/patches/{name}/{version}/status` — set active/deprecated/buggy | registry-api | Small | ✅ Done |
+| `POST /v1/patches/{name}/{version}/validate` — re-run A1-A10 on stored manifest | registry-api | Small | ✅ Done |
+| `GET /v1/patches/{name}/dependencies` — dependency tree for a package | registry-api | Small | ✅ Done |
+| File-backed store (JSON file, survives restarts, SQLite adapter interface ready) | None | Medium | ✅ Done |
+| `POST .../unlock` — unlock code verification | registry-api | Medium | Partial |
+| SQLite metadata index (upgrade from file-backed JSON) | None | Medium | Pending |
+| cgp-template with sample patch | cgp-format spec | Small | ✅ Done |
+| cgp-template README and documentation | None | Small | ✅ Done |
+| Registry API spec documenting notary proxy (no file hosting) | — | Small | ✅ Done |
+| `publish-cgp.sh` updated for notary pattern (JSON + sha256 + download-url) | — | Small | ✅ Done |
 
 **Definition of done:**
-- `cpm search email` returns results from the registry
-- `cpm publish ./skill.cgp` uploads to the registry
-- `cpm install <name>` downloads and installs from registry
-- Unlock code flow works end-to-end
-- `cpm init my-skill` creates a valid .cgp skeleton
+- `cpm search email` returns results from the registry ✅
+- `cpm publish ./skill.cgp --download-url <url>` registers checksum in registry ✅
+- `cpm install <name>` downloads from `download_url` after registry redirect ✅
+- Unlock code flow works end-to-end ⬜ (stub implementation)
+- A1-A10 validation rejects malformed publishes at registry level ✅
+- `cpm init my-skill` creates a valid .cgp skeleton ✅
 
 ## Build Order with Milestones
 
diff --git a/plan/milestones.md b/plan/milestones.md
index c917e19..9dfbf3e 100644
--- a/plan/milestones.md
+++ b/plan/milestones.md
@@ -45,12 +45,21 @@
 - [ ] Raw Model loads at boot
 - [ ] **Demo:** Boot CognitiveOS in QEMU, type a command, get a response
 
-## M6 — Registry Ecosystem
-- [ ] `GET /v1/search` returns results
-- [ ] `cpm publish ./skill.cgp` uploads to registry
-- [ ] `cpm install <name>` downloads from registry
-- [ ] Unlock code flow works end-to-end
-- [ ] `cpm init my-skill` creates valid .cgp skeleton
+## M6 — Registry Ecosystem (Notary Proxy)
+- [x] `GET /v1/search` returns results
+- [x] `GET /v1/patches/{name}/{version}` returns metadata with sha256 + download_url
+- [x] `GET /v1/patches/{name}/{version}/download` redirects to canonical download URL
+- [x] `POST /v1/patches` JSON-only publish with manifest + sha256 + download_url
+- [x] `PUT /v1/patches/{name}/{version}` publish new version
+- [x] A1-A10 publish-time validation (manifest, schema, cycles, file refs, hardware bounds, URLs)
+- [x] Scoped token auth (publish/admin)
+- [x] File-backed persistence (survives restarts)
+- [x] `PATCH .../status`, `POST .../validate`, `GET .../dependencies` endpoints
+- [x] `cpm publish ./skill.cgp --download-url <url>` registers in registry
+- [x] `cpm install <name>` downloads via registry redirect
+- [x] `cpm init my-skill` creates valid .cgp skeleton
+- [ ] SQLite backend (upgrade from file-backed JSON)
+- [ ] Full unlock code flow end-to-end
 - [ ] **Demo:** `cpm search photo` → `cpm install photo-viewer` → AI can show photos
 
 ## M7 — v0.1.0 Release