feat(console): manage source registries and discovery

docs/concepts/sources.md

@@ -101,6 +101,8 @@ Configured state, observed state, immutable refresh history, and cached bytes re
 
 Startup only ensures the local official registration and observed-state records; it performs no network request. Deleting an external registration removes desired configuration but preserves immutable refresh history and retained cache bytes for later provenance and retention processing. Registry availability therefore has no effect on direct Source imports or on already imported Sources, snapshots, Bootstrap Profiles, and Packs. See the [registration reference](../reference/source-registries.md) for the complete API and enterprise example.
 
+The Platform-administrator Console mirrors this boundary under **System > Source registries**: registration management and Registry refresh stay separate from imported Source and Channel administration. Discovery shows all retained observations and their independent trust evidence before an exact selection is confirmed; the resulting Source then continues through the existing Source, Channel, Bootstrap, and Pack workflows.
+
 ## Optional verification index
 
 Agentstration can consult a static verification index without making it a startup or offline dependency:

docs/reference/current-capabilities.md

@@ -40,6 +40,8 @@ The management plane is the source of truth for agent definitions and desired st
 
 The official static Source registry is available as an optional instance-owned discovery input, and Platform administrators can add independent community or private enterprise registrations. Registrations have ETag-protected CRUD, explicit trust/network/refresh/cache policies, and optional instance Secret references resolved only for exact same-origin requests. Manual and opt-in scheduled refreshes retrieve only compatible Registry v1 shards, validate canonical digests, retain a bounded last-known-good cache, and persist conditional HTTP, backoff, staleness, failure, and recovery state across restart. Registry trust evaluation preserves every observation, gates remote publisher assertions through local policy, rejects accepted digest conflicts and revocation, and feeds the existing exact SourceVersion verification boundary. Merged discovery remains offline; an explicit retained-observation selection retrieves and imports only one exact manifest with complete Registry provenance and no Channel materialization. It never equates a trusted origin or verified SourceVersion with a verified mutable Channel Snapshot or makes startup depend on the public network. See [Source registry registrations](source-registries.md).
 
+The Console exposes these operations under **System > Source registries**. It supports registration CRUD, enablement, manual refresh, refresh history, Secret-reference selection, merged discovery filters, all observation evidence, and exact import confirmation. The official registration, local origin policy, publisher evidence, SourceVersion verification, and later Snapshot verification are presented separately on responsive desktop and mobile layouts.
+
 ## Schedule Triggers
 
 Agentstration can submit autonomous Work from a declarative Workspace-scoped `Trigger`. Trigger owns **when**, Work owns **what**, Flow owns **how**, and Runtime owns execution. Automation is not a second runtime.

docs/reference/source-registries.md

@@ -14,6 +14,16 @@ The API supports:
 
 The official `agentstration-official` registration is created only when absent. Local changes survive restart and product upgrades. It can be disabled or reconfigured but not deleted.
 
+## Console workflow
+
+Platform administrators can use **System > Source registries** (`/settings/source-registries`) instead of calling these APIs directly. The registration list separates the well-known official registration from endpoints trusted by local policy and shows enabled state, endpoint type, freshness, last outcome, next scheduled refresh, and actionable errors. Each detail page provides ETag-protected editing, manual refresh, retained refresh history, and the current origin-trust explanation. A concurrency conflict must be resolved by reloading the latest server version before saving again.
+
+Private registrations select an existing instance-scoped Secret by reference. The Console uses the authorized Secret inventory and never requests, renders, or logs its value. Secret creation and value management remain in the canonical **Secrets** experience.
+
+Use the **Discover Sources** tab (`/settings/source-registries/discovery`) to apply the bounded server-side filters and inspect grouped portable identities. Every exact version retains all Registry observations and displays four independent dimensions: Registry origin trust, publisher evidence, SourceVersion verification, and Snapshot verification. Snapshot verification is explicitly not evaluated until a Channel is materialized. Shard-local `latest` markers never become a global latest version.
+
+Selecting an observation opens a confirmation that repeats the Registry registration, observation ID, shard, opaque version, and expected manifest digest. The server revalidates that retained tuple on confirmation. Conflicted, revoked, untrusted, or otherwise policy-denied choices remain unavailable; stale choices carry an explicit warning. A successful import opens the ordinary Source detail page and does not create or refresh Channels.
+
 ## Private enterprise example
 
 Create an instance-scoped Vault and Secret through the normal Secret APIs, store the Bearer token through the write-only Secret value endpoint, and retain only this reference in the registration:

src/Agentstration.Web.Components/MainLayout.razor.cs

@@ -23,7 +23,7 @@ private sealed record CommandItem(string Label, string Url, string Icon, string
         new("Group.Operate", [new("Nav.Triggers", "/triggers", "clock", "work"), new("Nav.Deployments", "/deployments", "server", "runtime"), new("Nav.Tasks", "/tasks", "tasks", "work")]),
         new("Group.Runs", [new("Nav.AgentRuns", "/agent-runs", "play-circle", "execution"), new("Nav.FlowRuns", "/flow-runs", "flow-run", "flow"), new("Nav.RunEvents", "/run-events", "activity")]),
         new("Group.Configure", [new("Nav.WorkplaceSetup", "/workspaces", "layout-grid", "work"), new("Nav.Packs", "/packs", "package"), new("Nav.Tools", "/tools", "wrench", "tool"), new("Nav.ModelProviders", "/modelproviders", "cpu", "model"), new("Nav.SourceProviders", "/sourceproviders", "database", "source"), new("Nav.RuntimeProfiles", "/runtimeprofiles", "cube", "runtime"), new("Nav.Secrets", "/secrets", "key")]),
-        new("Group.System", [new("Nav.ResourceScopes", "/settings/resource-scopes", "layers", RequiredPermissions: ["resources/read"]), new("Nav.Sources", "/settings/sources", "books"), new("Nav.Extensions", "/extensions", "puzzle"), new("Nav.Cleanup", "/cleanup", "trash", RequiredPermissions: ["resources/delete", "runs/delete"]), new("Nav.Organization", "/settings/organization", "building"), new("Nav.Bootstrap", "/settings/bootstrap", "upload-cloud"), new("Nav.Profile", "/settings/profile", "user-circle"), new("Nav.Settings", "/settings", "settings")])
+        new("Group.System", [new("Nav.ResourceScopes", "/settings/resource-scopes", "layers", RequiredPermissions: ["resources/read"]), new("Nav.Sources", "/settings/sources", "books"), new("Nav.SourceRegistries", "/settings/source-registries", "database"), new("Nav.Extensions", "/extensions", "puzzle"), new("Nav.Cleanup", "/cleanup", "trash", RequiredPermissions: ["resources/delete", "runs/delete"]), new("Nav.Organization", "/settings/organization", "building"), new("Nav.Bootstrap", "/settings/bootstrap", "upload-cloud"), new("Nav.Profile", "/settings/profile", "user-circle"), new("Nav.Settings", "/settings", "settings")])
     ];
 
     private static readonly CommandDefinition[] CommandDefinitions =
@@ -60,6 +60,8 @@ private sealed record CommandItem(string Label, string Url, string Icon, string
         new("Nav.Settings", "/settings", "⚙", "Group.System", "configuration paramètres"),
         new("Nav.ResourceScopes", "/settings/resource-scopes", "◇", "Group.System", "resource ownership hierarchy scopes ressources propriété hiérarchie", ["resources/read"]),
         new("Nav.Sources", "/settings/sources", "▤", "Group.System", "sources catalogs reusable content catalogues contenu réutilisable"),
+        new("Nav.SourceRegistries", "/settings/source-registries", "◫", "Group.System", "registry registries discovery trust registre registres découverte confiance"),
+        new("Command.DiscoverSources", "/settings/source-registries/discovery", "⌕", "Command", "registry catalog source discovery registre catalogue découverte"),
         new("Command.ProfileSettings", "/settings/profile", "○", "Group.System", "appearance theme personal preferences apparence thème préférences"),
         new("Nav.Extensions", "/extensions", "⬢", "Group.System", "AEP option contracts compatibility extensions"),
         new("Nav.Cleanup", "/cleanup", "⌫", "Group.System", "cleanup clean delete purge nettoyage suppression", ["resources/delete", "runs/delete"]),

src/Agentstration.Web.Components/Resources/MainLayoutStrings.fr-FR.resx

@@ -11,4 +11,6 @@
   <data name="Command.CreateAgent" xml:space="preserve"><value>Créer un agent</value></data><data name="Command.CreateModelProfile" xml:space="preserve"><value>Créer un profil de modèle</value></data><data name="Command.CreateFlow" xml:space="preserve"><value>Créer un Flow</value></data><data name="Command.CreateEntry" xml:space="preserve"><value>Créer une entrée</value></data><data name="Command.CreateToolProvider" xml:space="preserve"><value>Créer un fournisseur d’outils</value></data><data name="Command.CreateModelProvider" xml:space="preserve"><value>Créer un fournisseur de modèles</value></data><data name="Command.CreateRuntimeProfile" xml:space="preserve"><value>Créer un profil d’exécution</value></data><data name="Command.CreateSecret" xml:space="preserve"><value>Créer un secret</value></data><data name="Command.Vaults" xml:space="preserve"><value>Coffres</value></data><data name="Command.CreateVault" xml:space="preserve"><value>Créer un coffre</value></data><data name="Command.ProfileSettings" xml:space="preserve"><value>Paramètres du profil</value></data><data name="Command.OrganizationWorkspaces" xml:space="preserve"><value>Espaces de travail de l’organisation</value></data><data name="Command.OrganizationMembers" xml:space="preserve"><value>Membres de l’organisation</value></data>
   <data name="Nav.ResourceScopes" xml:space="preserve"><value>Périmètres</value></data>
   <data name="Nav.Sources" xml:space="preserve"><value>Sources</value></data>
+  <data name="Nav.SourceRegistries" xml:space="preserve"><value>Registres de Sources</value></data>
+  <data name="Command.DiscoverSources" xml:space="preserve"><value>Découvrir des Sources</value></data>
 </root>

src/Agentstration.Web.Components/Resources/MainLayoutStrings.resx

@@ -11,4 +11,6 @@
   <data name="Command.CreateAgent" xml:space="preserve"><value>Create agent</value></data><data name="Command.CreateModelProfile" xml:space="preserve"><value>Create model profile</value></data><data name="Command.CreateFlow" xml:space="preserve"><value>Create flow</value></data><data name="Command.CreateEntry" xml:space="preserve"><value>Create entry</value></data><data name="Command.CreateToolProvider" xml:space="preserve"><value>Create tool provider</value></data><data name="Command.CreateModelProvider" xml:space="preserve"><value>Create model provider</value></data><data name="Command.CreateRuntimeProfile" xml:space="preserve"><value>Create runtime profile</value></data><data name="Command.CreateSecret" xml:space="preserve"><value>Create secret</value></data><data name="Command.Vaults" xml:space="preserve"><value>Vaults</value></data><data name="Command.CreateVault" xml:space="preserve"><value>Create vault</value></data><data name="Command.ProfileSettings" xml:space="preserve"><value>Profile settings</value></data><data name="Command.OrganizationWorkspaces" xml:space="preserve"><value>Organization workspaces</value></data><data name="Command.OrganizationMembers" xml:space="preserve"><value>Organization members</value></data>
   <data name="Nav.ResourceScopes" xml:space="preserve"><value>Resource scopes</value></data>
   <data name="Nav.Sources" xml:space="preserve"><value>Sources</value></data>
+  <data name="Nav.SourceRegistries" xml:space="preserve"><value>Source registries</value></data>
+  <data name="Command.DiscoverSources" xml:space="preserve"><value>Discover Sources</value></data>
 </root>