fix: publish contracts from the live GitHub Pages registry

.github/workflows/codeql.yml

@@ -8,6 +8,7 @@ jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       actions: read
       contents: read

.github/workflows/compatibility.yml

@@ -2,6 +2,7 @@ name: Compatibility
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
     paths:
       - "schemas/**"
       - "scripts/compatibility.mjs"
@@ -42,6 +43,8 @@ jobs:
       - name: Classify changes
         id: classify
         shell: bash
+        env:
+          REVIEW_APPROVED: ${{ contains(github.event.pull_request.labels.*.name, 'compatibility-reviewed') }}
         run: |
           set +e
           node candidate/scripts/compatibility.mjs \
@@ -55,6 +58,10 @@ jobs:
             cat candidate/compatibility-report.json
             echo '```'
           } >> "$GITHUB_STEP_SUMMARY"
+          if [[ "$code" -eq 2 && "$REVIEW_APPROVED" == "true" ]]; then
+            echo "Compatibility review accepted through the compatibility-reviewed label." >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
           exit "$code"
       - name: Upload compatibility report
         if: always()

.github/workflows/pages.yml

@@ -9,8 +9,6 @@ on:
   workflow_dispatch:
 permissions:
   contents: read
-  pages: write
-  id-token: write
 # Single owner of the GitHub Pages deployment. Both the documentation site and
 # the schema registry are built into one artifact so a docs push and a schema
 # tag can never clobber each other on the single Pages origin.
@@ -70,10 +68,14 @@ jobs:
         with:
           path: ./site
   deploy:
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     needs: build
     steps:
       - name: Deploy to GitHub Pages

.github/workflows/pr-lint.yml

@@ -10,6 +10,9 @@ jobs:
   main:
     name: Validate PR title
     runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      pull-requests: read
     steps:
       - uses: amannn/action-semantic-pull-request@v5
         env:

.github/workflows/stale.yml

@@ -6,6 +6,10 @@ on:
 jobs:
   stale:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
     - uses: actions/stale@v8
       with:

docs/DISTRIBUTION.md

@@ -7,7 +7,7 @@ sub-path of the documentation site on a single GitHub Pages origin:
 https://coding-autopilot-system.github.io/cas-contracts/registry/
 ```
 
-Schema `$id` values use the reserved canonical namespace `https://schemas.coding-autopilot.dev/`. This namespace is the stable *identity* of each schema and is independent of where the schema is hosted. Until DNS is configured for that domain, consumers must resolve schemas from the live GitHub Pages distribution URL above.
+Schema `$id` values use the live GitHub Pages registry base `https://coding-autopilot-system.github.io/cas-contracts/registry/`, so every `$id` resolves directly to the schema it identifies. Identity and hosting location are the same URL; consumers can dereference an `$id` to fetch the schema.
 
 ## URL Contract
 
@@ -51,19 +51,11 @@ a schema tag can no longer clobber each other on the single Pages origin.
 
 Repository administrators must configure GitHub Pages to use **GitHub Actions** as its source. Publication uses GitHub's OIDC token and does not require stored deployment credentials.
 
-## Custom domain (manual follow-up)
-
-Serving the registry under the canonical `schemas.coding-autopilot.dev` `$id`
-namespace requires infrastructure that cannot be provisioned from this
-repository:
-
-1. Configure DNS for `schemas.coding-autopilot.dev` (a `CNAME` to
-   `coding-autopilot-system.github.io`, or the four GitHub Pages `A`/`AAAA`
-   apex records) with the domain registrar.
-2. Because the single Pages origin now hosts the documentation at its root and
-   the registry under `/registry/`, a custom domain would remap the **entire**
-   origin — it cannot point only at the `/registry/` sub-path. Activating
-   `schemas.coding-autopilot.dev` therefore requires a dedicated hosting origin
-   for the registry (for example, a separate Pages project or a CDN) rather than
-   the shared docs site. Until such an origin exists, resolve schemas from the
-   GitHub Pages URL above.
+## Custom domain (optional future work)
+
+Schema `$id` values resolve on the live GitHub Pages origin today, so no DNS or
+custom-domain work is required for schemas to dereference. A vanity domain (for
+example `schemas.coding-autopilot.dev`) would only be a cosmetic rename of the
+`$id` base and, if ever adopted, would require its own hosting origin plus a
+coordinated `$id` migration across this repository and every consumer that
+vendors these schemas. It is intentionally out of scope here.

examples/v0.1/artifact-manifest.json

@@ -11,7 +11,7 @@
   "artifacts": [
     {
       "kind": "schema",
-      "uri": "https://schemas.coding-autopilot.dev/v0.1/prompt-envelope.schema.json",
+      "uri": "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/prompt-envelope.schema.json",
       "sha256": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
     }
   ]

examples/v1.0/artifact-manifest.json

@@ -11,7 +11,7 @@
   "artifacts": [
     {
       "kind": "schema",
-      "uri": "https://schemas.coding-autopilot.dev/v1.0/prompt-envelope.schema.json",
+      "uri": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.0/prompt-envelope.schema.json",
       "sha256": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
     }
   ]

schemas/v0.1/artifact-manifest.schema.json

@@ -1,6 +1,6 @@
 {
     "$schema":  "https://json-schema.org/draft/2020-12/schema",
-    "$id":  "https://schemas.coding-autopilot.dev/v0.1/artifact-manifest.schema.json",
+    "$id":  "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/artifact-manifest.schema.json",
     "title":  "ArtifactManifest",
     "type":  "object",
     "allOf":  [

schemas/v0.1/common.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v0.1/common.schema.json",
+  "$id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/common.schema.json",
   "title": "CAS Common Definitions",
   "$defs": {
     "actor": {

schemas/v0.1/evaluation-result.schema.json

@@ -1,6 +1,6 @@
 {
     "$schema":  "https://json-schema.org/draft/2020-12/schema",
-    "$id":  "https://schemas.coding-autopilot.dev/v0.1/evaluation-result.schema.json",
+    "$id":  "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/evaluation-result.schema.json",
     "title":  "EvaluationResult",
     "type":  "object",
     "allOf":  [

schemas/v0.1/policy-decision.schema.json

@@ -1,6 +1,6 @@
 {
     "$schema":  "https://json-schema.org/draft/2020-12/schema",
-    "$id":  "https://schemas.coding-autopilot.dev/v0.1/policy-decision.schema.json",
+    "$id":  "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/policy-decision.schema.json",
     "title":  "PolicyDecision",
     "type":  "object",
     "allOf":  [

schemas/v0.1/prompt-envelope.schema.json

@@ -1,6 +1,6 @@
 {
     "$schema":  "https://json-schema.org/draft/2020-12/schema",
-    "$id":  "https://schemas.coding-autopilot.dev/v0.1/prompt-envelope.schema.json",
+    "$id":  "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/prompt-envelope.schema.json",
     "title":  "PromptEnvelope",
     "type":  "object",
     "allOf":  [

schemas/v0.1/run-event.schema.json

@@ -1,6 +1,6 @@
 {
     "$schema":  "https://json-schema.org/draft/2020-12/schema",
-    "$id":  "https://schemas.coding-autopilot.dev/v0.1/run-event.schema.json",
+    "$id":  "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/run-event.schema.json",
     "title":  "RunEvent",
     "type":  "object",
     "allOf":  [

schemas/v0.1/verification-result.schema.json

@@ -1,6 +1,6 @@
 {
     "$schema":  "https://json-schema.org/draft/2020-12/schema",
-    "$id":  "https://schemas.coding-autopilot.dev/v0.1/verification-result.schema.json",
+    "$id":  "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/verification-result.schema.json",
     "title":  "VerificationResult",
     "type":  "object",
     "allOf":  [

schemas/v0.1/work-request.schema.json

@@ -1,6 +1,6 @@
 {
     "$schema":  "https://json-schema.org/draft/2020-12/schema",
-    "$id":  "https://schemas.coding-autopilot.dev/v0.1/work-request.schema.json",
+    "$id":  "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/work-request.schema.json",
     "title":  "WorkRequest",
     "type":  "object",
     "allOf":  [

schemas/v1.0/artifact-manifest.schema.json

@@ -1,6 +1,6 @@
 {
     "$schema":  "https://json-schema.org/draft/2020-12/schema",
-    "$id":  "https://schemas.coding-autopilot.dev/v1.0/artifact-manifest.schema.json",
+    "$id":  "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.0/artifact-manifest.schema.json",
     "title":  "ArtifactManifest",
     "type":  "object",
     "allOf":  [

schemas/v1.0/common.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v1.0/common.schema.json",
+  "$id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.0/common.schema.json",
   "title": "CAS Common Definitions",
   "$defs": {
     "actor": {

schemas/v1.0/evaluation-result.schema.json

@@ -1,6 +1,6 @@
 {
     "$schema":  "https://json-schema.org/draft/2020-12/schema",
-    "$id":  "https://schemas.coding-autopilot.dev/v1.0/evaluation-result.schema.json",
+    "$id":  "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.0/evaluation-result.schema.json",
     "title":  "EvaluationResult",
     "type":  "object",
     "allOf":  [

schemas/v1.0/policy-decision.schema.json

@@ -1,6 +1,6 @@
 {
     "$schema":  "https://json-schema.org/draft/2020-12/schema",
-    "$id":  "https://schemas.coding-autopilot.dev/v1.0/policy-decision.schema.json",
+    "$id":  "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.0/policy-decision.schema.json",
     "title":  "PolicyDecision",
     "type":  "object",
     "allOf":  [

schemas/v1.0/prompt-envelope.schema.json

@@ -1,6 +1,6 @@
 {
     "$schema":  "https://json-schema.org/draft/2020-12/schema",
-    "$id":  "https://schemas.coding-autopilot.dev/v1.0/prompt-envelope.schema.json",
+    "$id":  "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.0/prompt-envelope.schema.json",
     "title":  "PromptEnvelope",
     "type":  "object",
     "allOf":  [

schemas/v1.0/run-event.schema.json

@@ -1,6 +1,6 @@
 {
     "$schema":  "https://json-schema.org/draft/2020-12/schema",
-    "$id":  "https://schemas.coding-autopilot.dev/v1.0/run-event.schema.json",
+    "$id":  "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.0/run-event.schema.json",
     "title":  "RunEvent",
     "type":  "object",
     "allOf":  [

schemas/v1.0/verification-result.schema.json

@@ -1,6 +1,6 @@
 {
     "$schema":  "https://json-schema.org/draft/2020-12/schema",
-    "$id":  "https://schemas.coding-autopilot.dev/v1.0/verification-result.schema.json",
+    "$id":  "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.0/verification-result.schema.json",
     "title":  "VerificationResult",
     "type":  "object",
     "allOf":  [

schemas/v1.0/work-request.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v1.0/work-request.schema.json",
+  "$id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.0/work-request.schema.json",
   "title": "WorkRequest",
   "type": "object",
   "allOf": [

schemas/v1.1/common.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v1.1/common.schema.json",
+  "$id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/common.schema.json",
   "title": "CAS Common Definitions v1.1",
   "$defs": {
     "actor": {

schemas/v1.1/phase-execution-request.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v1.1/phase-execution-request.schema.json",
+  "$id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/phase-execution-request.schema.json",
   "title": "PhaseExecutionRequest",
   "type": "object",
   "allOf": [

schemas/v1.1/phase-execution-result.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v1.1/phase-execution-result.schema.json",
+  "$id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/phase-execution-result.schema.json",
   "title": "PhaseExecutionResult",
   "type": "object",
   "allOf": [

schemas/v1.1/phase-verification-result.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v1.1/phase-verification-result.schema.json",
+  "$id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/phase-verification-result.schema.json",
   "title": "PhaseVerificationResult",
   "type": "object",
   "allOf": [

schemas/v1.1/sdlc-lifecycle-event.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v1.1/sdlc-lifecycle-event.schema.json",
+  "$id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/sdlc-lifecycle-event.schema.json",
   "title": "SdlcLifecycleEvent",
   "type": "object",
   "allOf": [

schemas/v1.1/sdlc-profile.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v1.1/sdlc-profile.schema.json",
+  "$id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/sdlc-profile.schema.json",
   "title": "SdlcProfile",
   "type": "object",
   "allOf": [

scripts/lib.mjs

@@ -43,5 +43,5 @@ export async function createValidator(directory = schemaRoot) {
 export function schemaIdForExample(examplePath) {
   const name = path.basename(examplePath, ".json");
   const version = path.basename(path.dirname(examplePath));
-  return `https://schemas.coding-autopilot.dev/${version}/${name}.schema.json`;
+  return `https://coding-autopilot-system.github.io/cas-contracts/registry/${version}/${name}.schema.json`;
 }

tests/contracts.test.mjs

@@ -32,7 +32,7 @@ test("each complete lifecycle preserves correlation and W3C trace context", () =
 test("contracts reject missing mandatory lifecycle metadata", () => {
   const invalid = structuredClone(examples.find((example) => example.kind === "PromptEnvelope" && example.schemaVersion === "0.1.0"));
   delete invalid.correlationId;
-  const validate = ajv.getSchema("https://schemas.coding-autopilot.dev/v0.1/prompt-envelope.schema.json");
+  const validate = ajv.getSchema("https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/prompt-envelope.schema.json");
 
   assert.equal(validate(invalid), false);
   assert.match(ajv.errorsText(validate.errors), /correlationId/);
@@ -41,14 +41,14 @@ test("contracts reject missing mandatory lifecycle metadata", () => {
 test("contracts reject malformed W3C traceparent values", () => {
   const invalid = structuredClone(examples.find((example) => example.kind === "RunEvent" && example.schemaVersion === "0.1.0"));
   invalid.traceContext.traceparent = "not-a-traceparent";
-  const validate = ajv.getSchema("https://schemas.coding-autopilot.dev/v0.1/run-event.schema.json");
+  const validate = ajv.getSchema("https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/run-event.schema.json");
 
   assert.equal(validate(invalid), false);
   assert.match(ajv.errorsText(validate.errors), /pattern/);
 });
 
 test("v1.1 SDLC profile accepts a complete twelve-phase profile", () => {
-  const validate = ajv.getSchema("https://schemas.coding-autopilot.dev/v1.1/sdlc-profile.schema.json");
+  const validate = ajv.getSchema("https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/sdlc-profile.schema.json");
   assert.ok(validate, "v1.1 profile schema is registered");
   const profile = {
     correlationId: "corr-1",
@@ -83,7 +83,7 @@ test("v1.1 SDLC profile accepts a complete twelve-phase profile", () => {
 });
 
 test("v1.1 SDLC request rejects missing profile version", () => {
-  const validate = ajv.getSchema("https://schemas.coding-autopilot.dev/v1.1/phase-execution-request.schema.json");
+  const validate = ajv.getSchema("https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/phase-execution-request.schema.json");
   assert.ok(validate, "v1.1 request schema is registered");
   const request = {
     correlationId: "corr-1",

tests/goal-contract.test.mjs

@@ -6,7 +6,7 @@ import { createValidator, readJson, root } from "../scripts/lib.mjs";
 const version = "v1.0";
 const schemaDirectory = path.join(root, "schemas", version);
 const examplePath = path.join(root, "examples", version, "work-request.json");
-const schemaId = "https://schemas.coding-autopilot.dev/v1.0/work-request.schema.json";
+const schemaId = "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.0/work-request.schema.json";
 
 const ajv = await createValidator(schemaDirectory);
 const validGoal = await readJson(examplePath);
@@ -70,13 +70,13 @@ test("v1 lifecycle rejects incomplete metadata and malformed trace context", ()
 
 test("v1 verification and evaluation records require evidence URIs", async () => {
   const verification = await readJson(path.join(root, "examples", version, "verification-result.json"));
-  const verificationValidator = ajv.getSchema("https://schemas.coding-autopilot.dev/v1.0/verification-result.schema.json");
+  const verificationValidator = ajv.getSchema("https://coding-autopilot-system.github.io/cas-contracts/registry/v1.0/verification-result.schema.json");
   const noVerificationEvidence = structuredClone(verification);
   delete noVerificationEvidence.checks[0].evidenceUri;
   assert.equal(verificationValidator(noVerificationEvidence), false);
 
   const evaluation = await readJson(path.join(root, "examples", version, "evaluation-result.json"));
-  const evaluationValidator = ajv.getSchema("https://schemas.coding-autopilot.dev/v1.0/evaluation-result.schema.json");
+  const evaluationValidator = ajv.getSchema("https://coding-autopilot-system.github.io/cas-contracts/registry/v1.0/evaluation-result.schema.json");
   const noEvaluationEvidence = structuredClone(evaluation);
   delete noEvaluationEvidence.evidence;
   assert.equal(evaluationValidator(noEvaluationEvidence), false);