feat(registry): spec 026 model rights gates, index projection, crate types (#620)

[enricopiovesan]

Summary

Implements spec 026-model-rights-compliance (decision-log entry 127) for registry-side schema, CI, index and crate. Signing and revoked.json validation are #621; the catalog is #622.

• CI gate check_new_contracts_declare_model_rights (ADD-only forward gate, wired into capability-validation). Every object ai.models entry on a newly added model-backed contract must declare:
  • commercial_use / redistribution / derivatives. unknown is rejected.
  • nothing in the hard-contradiction table: redistribution: forbidden; derivatives: forbidden together with a derivation; a non-redistributable SPDX marker together with redistribution: allowed.
  • license_files / notice_files as {url, sha256} on Registry Release assets, which CI fetches and digest-verifies. NOTICE is required when attribution_required is true.
  • an immutable upstream pin: a full commit id in revision, or inside source_url.
  • an explicit derivation, either an object or null, whose converted_sha256 must appear in the crate's model-weights.json.
  • optional data_obligations, which are validated when present.
  • verification.status: maintainer-declared. LicenseRef-* needs evidence_url.
  • FR-011 drift: any SPDX, attribution or rights difference against another published contract citing the same model id and pin fails, unless the entry carries rights_change {reason, evidence_url}.
• Index (build_index.py): each entry gains status (active|deprecated|revoked from deprecated.json / revoked.json) and a derived model_usage[] {id, usage_class}. The full ModelRef record still rides verbatim in ai.
• Crate traverse-registry 0.26.0: new model_rights module with typed PublicAiDeclaration / PublicModelRef / rights enums / ModelDerivationDeclaration / PublicRecordStatus. PublicRegistryCapabilityRecord gains ai, status and model_usage (all serde(default), so older index.json files still deserialize). Exact and range resolution now skip revoked as well as deprecated records.
• Docs and example: docs/model-rights.md covers publisher and consumer obligations plus every error code. examples/model-rights/ is the SC-005 package (LICENSE, NOTICE, attribution, provenance, derivation, data obligations); its sha256 values are real hashes of the files in release-assets/.

Notable choices

• derivation is a required key; null means shipped verbatim. CI cannot detect a conversion it is never told about, so requiring the key turns spec FR-006's "when weights differ" into an explicit statement instead of silence.
• Drift is a single whole-tree comparison on (model id, pin). That covers both earlier versions of the same capability and other capabilities. Only fields that both sides declare are compared, so pre-026 references constrain SPDX/attribution without blocking the new rights enums.
• Revoked handling in the crate: an exact pin to a revoked record does not resolve. This matches the crate's existing treatment of deprecated records. Traverse-side runtime policy is Consume registry spec 026 model rights: CLI inspect, honor revoked, verify contract signature traverse#1598.
• Existing published contracts are untouched and still pass. The real generated index (225 entries, 13 with ai) deserializes with the new crate types.

Governing Spec

• 026-model-rights-compliance
• 010-crate-publish-pipeline
• 001-registry-foundation

Project Item

Closes #620

Definition of Done

• Fixtures for permissive, evaluation-only, conditional and deprecated (SC-001); revoked index status covered in advance of Spec 026: contract-hash signing + revoked.json lifecycle marker #621
• Every SC-002 negative case fails with a stable error code
• Index round-trip tests: no rights field is dropped (SC-004); crate round-trip test as well
• All existing contracts still pass (SC-006)
• cargo test and clippy -D warnings for traverse-registry are green; pre_pr_check.sh is green
• Publisher and consumer docs, plus the example package (SC-005, FR-016)

Validation

• python3 -m unittest scripts/ci/tests/test_capability_validation.py: 32 new spec 026 tests
• python3 -m unittest scripts/ci/tests/test_build_index.py: 5 new spec 026 tests
• cargo test -p traverse-registry --locked: 233 lib tests, including 10 new
• cargo clippy -p traverse-registry --all-targets --locked -- -D warnings
• bash scripts/ci/pre_pr_check.sh

🤖 Generated with Claude Code