Registry

registry.yaml is the single declarative list of repos governed by the petrova control plane. Every verb invocation looks up its target here first. A repo absent from the registry is invisible to the verb surface.

Schema

The full JSON Schema lives at registry.schema.json. Each entry:

- slug: kahn-hq                              # local identifier (kebab-case)
  url: https://github.com/kahn-hq/kahn       # canonical git remote
  default_branch: main
  role: production                           # control-plane | production | experimental | scaffold | archived
  profile: standard                          # strict | standard | permissive
  fleets_allowed:
    - kahn-implementer
    - kahn-diagnostics
  contract_committers:                       # who may commit .petrova/contract.yaml; default ['humans']
    - humans
  integrations_applicability:                # governance override of consumer self-declaration
    lore: required
  added: "2026-04-29"
  notes: |
    Free-text rationale, optional.

Field semantics

Field	Effect
`slug`	What you pass as `<repo>` to every verb. Also resolves to `$PETROVA_WORKSPACE/<slug>` for local-clone reads.
`url`	Canonical git remote. The skills’ `repo-slug.sh` matches `git remote get-url origin` against this to derive the slug.
`role`	Informational, but drives template choices and onboarding sanity-checks.
`profile`	Gates `request_merge_when_green`. See profiles.
`fleets_allowed`	The list of `fleet:<id>` actors permitted to invoke write verbs. Empty means human-only writes. See fleets.
`contract_committers`	Allowlist of identities permitted to commit the consumer’s `.petrova/contract.yaml`. Default `['humans']`. See below.
`integrations_applicability`	Governance-level applicability matrix that overrides the consumer’s own contract self-declaration. See below.

Write-authority gates

fleets_allowed is not the only write-authority primitive. Two more live in the registry entry, and both are governance gates in their own right:

contract_committers controls who may edit a consumer’s intent declaration (.petrova/contract.yaml). It defaults to ['humans']. Adding a fleet identity to this list is itself a governance change — it grants an agent authority over the very file that declares the repo’s posture — and requires justification in the entry’s notes:.

integrations_applicability is a governance-level override matrix. It outranks the consumer’s own contract self-declaration: if a consumer marks an integration not_applicable while governance says required, that is a CI failure (it surfaces as failing on the dashboard, not as the consumer’s asserted state). This is the same intent-vs-observation discipline the governance audit enforces under MR-13/MR-14 — a repo cannot self-exempt from a governance requirement.

Edits go through PRs

Registry changes are PR-emitting, never direct pushes — even from the operator who owns the control plane. The mechanism for adding or modifying an entry is petrova request_review petrova-codes against the file. The onboard-a-repo runbook walks through this end-to-end.

This is not ceremony. The registry is the security boundary that admits a repo to the verb surface; an unreviewed registry edit could silently grant write capability to a fleet that hadn’t earned it.

Verification on load