Registry

Registry is a standalone HTTP service: publish packages, manage orgs, store results, sign in.
It is not the local Viewer and not ageval Core.

The CLI defaults to the public Hub at https://ageval.zjureal.com; login does not require a URL first. Override with AGEVAL_REGISTRY_URL or --registry-url to self-host.

Flow

1. Start a self-hosted service per services/registry/README.md. Release tags push Registry and Hub images to GHCR; compose starts Postgres, object storage, Registry, and Hub together
2. After CLI login: create an org. Upload a Dataset draft with ageval publish --draft; an owner promotes it with ageval release. Direct ageval publish still creates a release. Upload suite / Attempt results as needed
3. Share private results with an org or user when you want
4. Browse on the Hub web UI; Hub uses browser OAuth, CLI uses Device Flow

Exact commands: ageval --help and the registry README.

Ownership (summary)

Joining an org does not reveal others’ private results until they share.
Any org member may publish under that org; package delete / set-visibility / --replace require org owner.
Invite keys show the full secret only once at create time; later you only see a prefix.
Owners or admins add / remove members by GitHub login (ageval registry org-add-member / org-remove-member); change an existing member’s role with org-set-role; hand the org to a current member with org-transfer (caller becomes member). The last owner cannot leave, be demoted, or be removed. The person need not be logged in. Allowlisted official slugs (default official) cannot be self-serve created or claimed — only an admin bootstrap token can org-create them.

Git-sourced datasets

A Dataset hosted in a git repository can be run directly (ageval run github:org/repo@v1.0.0, optionally #<subdir>) and registered on the Hub without uploading files: ageval publish --repo github:org/repo@v1.0.0. An https URL must not embed userinfo (https://<token>@host or https://user:pass@host); the Hub stores only an https URL without userinfo, or git@host:path. Registration pins the resolved commit and an evaluation digest over the scoring files; re-registering the same version with different scoring files is rejected, while documentation-only changes are accepted. Suite results from a registered source are attributed to that version; results from unregistered sources are stored but not ranked. The Dataset page links to the pinned commit and shows any declared prepare script and assets for review.

Owner ops after create (CLI)

--public at create time only sets initial visibility. Owners can change it later without republishing:

# Members by GitHub login (owner or admin; target need not be logged in)
# ageval registry org-add-member my-lab alice --role member
# ageval registry org-set-role my-lab alice --role owner
# ageval registry org-transfer my-lab alice
# ageval registry org-remove-member my-lab alice

# Package: visibility / delete (delete requires --yes)
ageval registry set-visibility 'my-org/dataset@0.1.0' --visibility public
# ageval registry delete 'my-org/dataset@0.1.0' --yes

# Package: description (owner override, no republish; empty string clears back to the manifest description)
ageval registry set-description my-org/dataset --description 'One-line description'

# Results: visibility / unshare / delete
ageval results set-visibility <run_or_suite_id> --kind attempt|suite --visibility private
ageval results unshare <id> --kind attempt --share-org my-lab
# ageval results delete <id> --kind suite --yes
# Suite delete does not cascade attempts by default:
# ageval results delete <suite_id> --kind suite --with-attempts --yes

Replace: same dataset_id@version / run_id / suite_run_id still 409 by default.
Owners may pass --replace on ageval publish / results upload / upload-suite to overwrite blob, metrics/labels, and visibility — never silent.

Details: ageval --help, src/ageval/cli/README.md, and the registry README.

Whether the service is public is an ops choice.