[leifj]

Documents the re-integration of the VCTM registry into the roles-based go-wallet-backend binary. Source of truth: sirosfoundation/go-wallet-backend#431 (fixes #430). This should merge with or after that PR; the content applies from the backend release that includes it (no version number stated).

Pages

• New docs/wallet/registry.md (Credential Manager Deployment section, sidebar is autogenerated): --mode=registry and combinable roles, the registry: config section and WALLET_REGISTRY_* env vars, registry-only listen address (server.registry_host/registry_port, 8097), authentication (shared token validator, wallet-registry audience, JWKS from as.external_url, legacy HMAC, what a registry-only require_auth deployment must set), the go-wallet-registry helper image, deprecation plan and old-to-new mapping table.
• docs/wallet/configuration.md: registry_host/registry_port rows and a VCTM Registry subsection pointing to the new page.
• docs/wallet/architecture/index.md: link the registry role row, note that --mode roles are combinable.
• docs/sirosid/reference/vctm-registry.md: the go-wallet-backend/cmd/registry reference is now the registry role (cmd/registry is gone).

Left alone: the vc/Token Status List registry, registry-cli/registry.siros.org pages and trust-registry pages (different registries); docs/wallet/wallet-backend-configuration/ is generated from go-wallet-backend CONFIGURATION.md and gitignored.

All keys, env vars, ports and behaviours were checked against the PR branch (pkg/config/config.go, generated docs/CONFIGURATION.md, docs/REGISTRY_MIGRATION.md, docs/DEPLOYMENT.md, configs/config.registry.yaml).

Checks

pnpm install --frozen-lockfile and pnpm build run; after make fetch-config-docs the only broken links are pre-existing (/opensource/release-notes/, /api/*.yaml generated assets), none from these pages. The /wallet/wallet-backend-configuration#registry anchor resolves only once a config reference containing the registry section is published.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

The migration precedence and issuer-validation guidance do not match the referenced backend implementation.

Review effort: Balanced
Findings: 2

Open (2)

• Issuer settings differ for asymmetric and legacy HMAC tokens · New
• Deprecated registry values merge per key, not all-or-nothing · New

What changed in this PR

Documents the VCTM registry’s reintegration as a go-wallet-backend role.

Changes:

• Adds registry deployment, configuration, authentication, and migration guidance.
• Documents registry server settings and combinable roles.
• Updates existing registry terminology and links.

File	Description
docs/​wallet/​registry.md	Adds comprehensive registry-role documentation.
docs/​wallet/​configuration.md	Adds registry configuration references.
docs/​wallet/​architecture/​index.md	Documents the registry role and combined modes.
docs/​sirosid/​reference/​vctm-registry.md	Updates the registry component description.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

The main-image example cannot persist its documented cache, and optional token recognition is overstated.

Review effort: Balanced
Findings: None

Resolved since last review (2)

• Deprecated registry values merge per key, not all-or-nothing
• Issuer settings differ for asymmetric and legacy HMAC tokens

Previously missed (2)

In code that hasn't changed since last review

Create a writable cache path for UID 65532

docs/​wallet/​registry.md:25

This main-image command leaves the documented cache path (/app/data/vctm-cache.json below) unwritable. The main Dockerfile switches to UID 65532 without creating /app/data; only the helper Dockerfile.registry creates and chowns that directory. As a result, each fetch logs a cache-save error and restarts cannot use the disk cache. Add a writable cache mount (with ownership for UID 65532), or change the example to a writable mounted path.

Configure token validation to enable the authenticated rate limit

docs/​wallet/​registry.md:68

Token recognition in optional-auth mode is conditional. NewRegistryProvider only constructs a validator when as.external_url is set or legacy auth is enabled with a non-empty jwt.secret; with the minimal configuration above, every request remains unauthenticated and receives the lower rate limit. State that validator settings are required to receive the authenticated rate limit.