openregs serve

Answer questions over a release, with citations, on HTTP.

Serve one built release over REST. POST /v1/answer with {query, as_of, release, filters} and get back the retrieval closure: the units that matched, the article and chapter each one sits in, the definitions in scope on the date, whatever amends or disapplies them, and the obligation atoms written into them — every content block carrying an eId or an atom id plus the release tag. The release is VERIFIED BEFORE THE SOCKET IS BOUND — the whole signature chain when it is signed, its digests and its own provenance when it is this checkout’s own build — and one that fails a check is refused with the failing check named, unless —insecure-skip-verify is passed. Every response is stamped with what was checked. The socket binds first so that GET /healthz answers 200 from boot while GET /readyz answers 503 until a verified release is loaded; until then no other route is served at all. Bearer-token authentication, per-token rate limiting, CORS and the SIGTERM drain are read from the deployment policy (—config). as_of and release default to today and the newest release, and are echoed on every response so an answer can be asked for again.

openregs serve [-h] [--release <regime>@<tag>] [--path <release-dir>]
                      [--insecure-skip-verify] [--key <cosign.pub>] [--log-key <log.pub>]
                      [--trust <path>] [--host <host>] [--port <port>] [--as-of <YYYY-MM-DD>]
                      [--mcp] [--config <serving.yaml>] [--root <path>]

Option
--release <regime>@<tag>	the release to serve; defaults to the newest built release in the checkout
--path <release-dir>	serve the release in this directory instead of resolving —release in the checkout — the air-gapped shape: openregs pull vendors a release, this serves it, and nothing else is needed
--insecure-skip-verify	start even though the release has not been verified. The only way past the check, and it is never right in production: every response is stamped verification: skipped and the startup log says so in full
--key <cosign.pub>	a signing key to accept when verifying a signed release, repeatable. Given, it replaces the roster. Default: config/trust.yaml (repeatable)
--log-key <log.pub>	a transparency-log key to accept, repeatable (repeatable)
--trust <path>	read the trust roster here instead of config/trust.yaml
--host <host>	address to bind (default 127.0.0.1)
--port <port>	port to bind; 0 lets the kernel choose and the chosen port is printed (default 8080)
--as-of <YYYY-MM-DD>	the date a request that states no as_of is answered for, instead of today — the one value in a response that is not a function of the release and the request, so pinning it makes every response reproducible
--mcp	speak the Model Context Protocol on stdin/stdout instead of REST, exposing the five tools search_regulation, get_unit, get_atom, diff_releases and list_obligations over the same release and the same closure; —host and —port do not apply
--config <serving.yaml>	the deployment policy — bearer tokens, per-token rate limits, CORS origins and the shutdown drain — instead of <root>/config/serving.yaml. It is read before the socket is bound, and a policy that does not parse is a server that does not start
--root <path>	repo root