registry: name the public registry network.auths.dev (one const, no silent default)

crates/auths-cli/src/commands/namespace.rs

@@ -60,7 +60,7 @@ pub enum NamespaceSubcommand {
         #[arg(long)]
         package_name: String,
 
-        /// Registry URL (defaults to the public registry)
+        /// Registry URL (no default)
         #[arg(long)]
         registry_url: Option<String>,
 
@@ -83,7 +83,7 @@ pub enum NamespaceSubcommand {
         #[arg(long)]
         delegate_did: String,
 
-        /// Registry URL (defaults to the public registry)
+        /// Registry URL (no default)
         #[arg(long)]
         registry_url: Option<String>,
 
@@ -106,7 +106,7 @@ pub enum NamespaceSubcommand {
         #[arg(long)]
         new_owner_did: String,
 
-        /// Registry URL (defaults to the public registry)
+        /// Registry URL (no default)
         #[arg(long)]
         registry_url: Option<String>,
 
@@ -125,7 +125,7 @@ pub enum NamespaceSubcommand {
         #[arg(long)]
         package_name: String,
 
-        /// Registry URL (defaults to the public registry)
+        /// Registry URL (no default)
         #[arg(long)]
         registry_url: Option<String>,
     },

crates/auths-cli/src/commands/verify_helpers.rs

@@ -88,11 +88,12 @@ pub fn parse_witness_keys(keys: &[String]) -> Result<Vec<(String, Vec<u8>)>> {
 
 /// The registry URL to use, or an actionable error when none is configured.
 ///
-/// There is no default registry: auths is offline-first, and the one that used to
-/// be baked in (`https://registry.auths.dev`) returned HTTP 404 — a default that
-/// looks configured and fails at the network. Registry-dependent verbs resolve
-/// through here so the refusal is stated once, at the CLI boundary, in terms of
-/// what the user can do about it.
+/// There is no default registry: auths is offline-first, and defaulting to our
+/// public one (`auths_sdk::PUBLIC_REGISTRY_URL`, `https://network.auths.dev`)
+/// would quietly centralize a network meant to be federated. It stays opt-in —
+/// pass `--registry <url>` (ours or your own) or set `AUTHS_REGISTRY_URL`.
+/// Registry-dependent verbs resolve through here so the refusal is stated once,
+/// at the CLI boundary, in terms of what the user can do about it.
 ///
 /// Args:
 /// * `configured`: The value of `--registry` / `AUTHS_REGISTRY_URL`, if any.
@@ -104,8 +105,9 @@ pub fn parse_witness_keys(keys: &[String]) -> Result<Vec<(String, Vec<u8>)>> {
 pub fn require_registry(configured: Option<String>) -> Result<String> {
     configured.ok_or_else(|| {
         anyhow!(
-            "{}",
-            auths_sdk::domains::identity::error::RegistrationError::NoRegistryConfigured
+            "{}\nOur public registry is {} — pass it, or point --registry at your own.",
+            auths_sdk::domains::identity::error::RegistrationError::NoRegistryConfigured,
+            auths_sdk::PUBLIC_REGISTRY_URL
         )
     })
 }

crates/auths-sdk/README.md

@@ -89,7 +89,7 @@ let config = DeveloperSetupConfig::builder("main".into())
     .with_platform(PlatformVerification::GitHub {
         access_token: "ghp_abc123".into(),
     })
-    .with_registration("https://registry.auths.dev")
+    .with_registration("https://network.auths.dev")
     .build();
 let result = setup_developer(config, &ctx)?;
 

crates/auths-sdk/src/domains/identity/registration.rs

@@ -14,20 +14,22 @@ use crate::domains::identity::types::RegistrationOutcome;
 
 // There is deliberately no default registry URL.
 //
-// There used to be one — `https://registry.auths.dev` — and it returned HTTP 404
-// (Vercel: DEPLOYMENT_NOT_FOUND). Every registry-touching command therefore shipped
-// with a default pointing at a host that does not exist, which is the worst
-// possible failure shape: it looks configured and fails at the network.
+// We *do* run a first-party public registry — `crate::PUBLIC_REGISTRY_URL`
+// (`https://network.auths.dev`) — but it is offered as one option, never baked
+// in as the implicit fallback. A silent default would make our infrastructure
+// everyone's default and centralize the very network the deploy charts
+// (helm/terraform/compose) exist to let anyone federate — the opposite of the
+// "no central server" headline claim.
 //
-// Nothing needs it. Identity, signing, and verification are entirely local and
-// git-native — a signer's KEL travels to a relying party inside the committed
-// identity bundle (`auths id export-bundle` → `.auths/ci-bundle.json`). "No
-// central server" is the product's headline claim, and a default that
-// contradicts it is worse than no default.
+// Nothing needs a registry anyway. Identity, signing, and verification are
+// entirely local and git-native — a signer's KEL travels to a relying party
+// inside the committed identity bundle (`auths id export-bundle` →
+// `.auths/ci-bundle.json`).
 //
-// A registry is now opt-in and explicit: pass `--registry <url>` or set
-// `AUTHS_REGISTRY_URL`. Callers surface `RegistrationError::NoRegistryConfigured`
-// when a registry-dependent verb is invoked without one.
+// A registry is thus opt-in and explicit: pass `--registry <url>` (ours or your
+// own) or set `AUTHS_REGISTRY_URL`. Callers surface
+// `RegistrationError::NoRegistryConfigured` when a registry-dependent verb is
+// invoked without one.
 
 #[derive(Serialize)]
 struct RegistryOnboardingPayload {
@@ -56,7 +58,7 @@ struct RegistrationResponse {
 /// ```ignore
 /// let outcome = register_identity(
 ///     identity_storage, registry, attestation_source,
-///     "https://registry.auths.dev", None, &http_client,
+///     "https://network.auths.dev", None, &http_client,
 /// ).await?;
 /// ```
 pub async fn register_identity(

crates/auths-sdk/src/domains/identity/types.rs

@@ -157,7 +157,7 @@ impl CreateDeveloperIdentityConfigBuilder {
     /// Usage:
     /// ```ignore
     /// let config = CreateDeveloperIdentityConfig::builder("my-key")
-    ///     .with_registration("https://registry.auths.dev")
+    ///     .with_registration("https://network.auths.dev")
     ///     .build();
     /// ```
     pub fn with_registration(mut self, url: impl Into<String>) -> Self {

crates/auths-sdk/src/lib.rs

@@ -20,6 +20,18 @@
 //! SDK functions accept typed configs and return structured `Result` types.
 //! They never prompt for input, print to stdout, or call `process::exit()`.
 
+/// The Auths-operated first-party public registry.
+///
+/// This is the canonical home for the URL — reference it instead of re-typing
+/// the literal, so the value lives in exactly one place. It is a *named
+/// reference*, **not** an implicit default: registry-touching commands still
+/// require an explicit `--registry`/`AUTHS_REGISTRY_URL`. Baking it in as a
+/// silent fallback would make our infrastructure everyone's default and
+/// centralize the very network the deploy charts exist to let anyone federate
+/// (and the core verbs — identity, signing, verification — need no registry at
+/// all). It is one option a party may opt into; running your own is another.
+pub const PUBLIC_REGISTRY_URL: &str = "https://network.auths.dev";
+
 // ── Re-export modules: types from auths-core, auths-id, auths-storage ──
 // These allow CLI and API consumers to import through auths-sdk instead of
 // depending on lower-layer crates directly.

crates/auths-sdk/src/pairing/mod.rs

@@ -93,7 +93,7 @@ pub enum PairingError {
 /// ```ignore
 /// let params = PairingSessionParams {
 ///     controller_did: "did:keri:abc123".into(),
-///     registry: "https://registry.auths.dev".into(),
+///     registry: "https://network.auths.dev".into(),
 ///     capabilities: vec![Capability::sign_commit()],
 ///     expiry_secs: 300,
 /// };
@@ -244,7 +244,7 @@ pub fn verify_device_did(
 /// ```ignore
 /// let req = build_pairing_session_request(PairingSessionParams {
 ///     controller_did: "did:keri:abc123".into(),
-///     registry: "https://registry.auths.dev".into(),
+///     registry: "https://network.auths.dev".into(),
 ///     capabilities: vec![Capability::sign_commit()],
 ///     expiry_secs: 300,
 /// })?;

crates/auths-sdk/src/workflows/transparency.rs

@@ -105,7 +105,7 @@ fn operator_info_from_wire(w: &TrustRootWitnessResponse) -> Option<WitnessOperat
 ///
 /// Usage:
 /// ```ignore
-/// let trust_root = fetch_trust_root("https://registry.auths.dev", &http_client).await?;
+/// let trust_root = fetch_trust_root("https://network.auths.dev", &http_client).await?;
 /// ```
 pub async fn fetch_trust_root(
     registry_url: &str,

docs/cli/commands/advanced.md

@@ -15,7 +15,7 @@ Publish a signed artifact attestation to the Auths registry.
 |------|---------|-------------|
 | `--signature <PATH>` | — | Path to an existing .auths.json signature file. Defaults to <FILE>.auths.json |
 | `--package <PACKAGE>` | — | Package identifier for registry indexing (e.g., npm:react@18.3.0) |
-| `--registry <REGISTRY>` | `https://registry.auths.dev` | Registry URL to publish to [env: AUTHS_REGISTRY_URL=] |
+| `--registry <REGISTRY>` | — | Registry URL to publish to [env: AUTHS_REGISTRY_URL=] |
 | `-j, --json` | — | Emit machine-readable JSON |
 | `-q, --quiet` | — | Suppress non-essential output |
 | `--repo <REPO>` | — | Override the local storage directory (default: ~/.auths) |
@@ -62,7 +62,7 @@ Sign and publish an artifact attestation to a registry
 |------|---------|-------------|
 | `--signature <PATH>` | — | Path to an existing .auths.json signature file. Defaults to <FILE>.auths.json |
 | `--package <PACKAGE>` | — | Package identifier for registry indexing (e.g., npm:react@18.3.0) |
-| `--registry <REGISTRY>` | `https://registry.auths.dev` | Registry URL to publish to [env: AUTHS_REGISTRY_URL=] |
+| `--registry <REGISTRY>` | — | Registry URL to publish to [env: AUTHS_REGISTRY_URL=] |
 | `--key <KEY>` | — | Local alias of the identity key. Omit for device-only CI signing |
 | `--device-key <DEVICE_KEY>` | — | Local alias of the device key. Auto-detected when only one key exists |
 | `--expires-in <N>` | — | Duration in seconds until expiration |
@@ -259,7 +259,7 @@ Publish this identity to a public registry for discovery
 
 | Flag | Default | Description |
 |------|---------|-------------|
-| `--registry <REGISTRY>` | `https://registry.auths.dev` | Registry URL to publish to [env: AUTHS_REGISTRY_URL=] |
+| `--registry <REGISTRY>` | — | Registry URL to publish to [env: AUTHS_REGISTRY_URL=] |
 | `-j, --json` | — | Emit machine-readable JSON |
 | `-q, --quiet` | — | Suppress non-essential output |
 | `--repo <REPO>` | — | Override the local storage directory (default: ~/.auths) |
@@ -751,7 +751,7 @@ Claim a namespace in a package ecosystem
 |------|---------|-------------|
 | `--ecosystem <ECOSYSTEM>` | — | Package ecosystem (e.g. npm, crates.io, pypi) |
 | `--package-name <PACKAGE_NAME>` | — | Package name to claim |
-| `--registry-url <REGISTRY_URL>` | — | Registry URL (defaults to the public registry) |
+| `--registry-url <REGISTRY_URL>` | — | Registry URL (no default) |
 | `--key <KEY>` | — | Alias of the signing key in keychain |
 | `-j, --json` | — | Emit machine-readable JSON |
 | `-q, --quiet` | — | Suppress non-essential output |
@@ -772,7 +772,7 @@ Delegate namespace authority to another identity
 | `--ecosystem <ECOSYSTEM>` | — | Package ecosystem (e.g. npm, crates.io, pypi) |
 | `--package-name <PACKAGE_NAME>` | — | Package name |
 | `--delegate-did <DELEGATE_DID>` | — | DID of the identity to delegate to |
-| `--registry-url <REGISTRY_URL>` | — | Registry URL (defaults to the public registry) |
+| `--registry-url <REGISTRY_URL>` | — | Registry URL (no default) |
 | `--key <KEY>` | — | Alias of the signing key in keychain |
 | `-j, --json` | — | Emit machine-readable JSON |
 | `-q, --quiet` | — | Suppress non-essential output |
@@ -793,7 +793,7 @@ Transfer namespace ownership to another identity
 | `--ecosystem <ECOSYSTEM>` | — | Package ecosystem (e.g. npm, crates.io, pypi) |
 | `--package-name <PACKAGE_NAME>` | — | Package name |
 | `--new-owner-did <NEW_OWNER_DID>` | — | DID of the new owner |
-| `--registry-url <REGISTRY_URL>` | — | Registry URL (defaults to the public registry) |
+| `--registry-url <REGISTRY_URL>` | — | Registry URL (no default) |
 | `--key <KEY>` | — | Alias of the signing key in keychain |
 | `-j, --json` | — | Emit machine-readable JSON |
 | `-q, --quiet` | — | Suppress non-essential output |
@@ -813,7 +813,7 @@ Look up namespace information
 |------|---------|-------------|
 | `--ecosystem <ECOSYSTEM>` | — | Package ecosystem (e.g. npm, crates.io, pypi) |
 | `--package-name <PACKAGE_NAME>` | — | Package name |
-| `--registry-url <REGISTRY_URL>` | — | Registry URL (defaults to the public registry) |
+| `--registry-url <REGISTRY_URL>` | — | Registry URL (no default) |
 | `-j, --json` | — | Emit machine-readable JSON |
 | `-q, --quiet` | — | Suppress non-essential output |
 | `--repo <REPO>` | — | Override the local storage directory (default: ~/.auths) |
@@ -1034,7 +1034,7 @@ Join an organization using an invite code
 | Flag | Default | Description |
 |------|---------|-------------|
 | `--code <CODE>` | — | Invite code (e.g. from `auths org join --code C23BD59F`) |
-| `--registry <REGISTRY>` | `https://registry.auths.dev` | Registry URL to contact [env: AUTHS_REGISTRY_URL=] |
+| `--registry <REGISTRY>` | — | Registry URL to contact [env: AUTHS_REGISTRY_URL=] |
 | `-j, --json` | — | Emit machine-readable JSON |
 | `-q, --quiet` | — | Suppress non-essential output |
 | `--repo <REPO>` | — | Override the local storage directory (default: ~/.auths) |

docs/cli/commands/primary.md

@@ -19,7 +19,7 @@ Create your signing identity and configure Git
 | `--key-alias <KEY_ALIAS>` | `main` | Key alias for the identity key (default: main) |
 | `--force` | — | Force overwrite if identity already exists |
 | `--dry-run` | — | Preview agent configuration without creating files or identities |
-| `--registry <REGISTRY>` | `https://registry.auths.dev` | Registry URL for identity registration [env: AUTHS_REGISTRY_URL=] |
+| `--registry <REGISTRY>` | — | Registry URL for identity registration [env: AUTHS_REGISTRY_URL=] |
 | `--register` | — | Register identity with the Auths Registry after creation |
 | `--github-action` | — | Scaffold a GitHub Actions workflow using the auths attest-action |
 | `--device-count <DEVICE_COUNT>` | `1` | Number of device slots for a multi-key KEL (default 1) |

docs/getting-started/sharing-your-identity.md

@@ -74,9 +74,10 @@ with GitHub, and publishes a signed proof (a GitHub Gist).
 auths id register
 ```
 
-publishes your identity document to a registry so others can discover it by DID. The
-default registry (`https://registry.auths.dev`) is not yet live — registration is
-**opt-in** (`auths init --register`) and nothing is published during normal setup.
+publishes your identity document to a registry so others can discover it by DID.
+There is no default registry — registration is **opt-in** (`auths init --register`)
+and nothing is published during normal setup. Point `--registry` at our public
+registry (`https://network.auths.dev`) or one you run yourself.
 Until the registry ships, bundles and the committed `.auths/roots` file are the
 supported sharing mechanisms.
 

docs/guides/identity/profiles.md

@@ -51,7 +51,7 @@ auths init --profile developer --non-interactive --key-alias my-key
 | `--key-alias` | `main` | Alias for the identity key |
 | `--force` | `false` | Overwrite existing identity |
 | `--non-interactive` | `false` | Skip all prompts, use defaults |
-| `--registry` | `https://registry.auths.dev` | Registry URL for identity registration (registry not yet live) |
+| `--registry` | `—` | Registry URL for identity registration (no default; e.g. `https://network.auths.dev`) |
 | `--register` | `false` | Register identity with the Auths Registry |
 
 ### CI profile

docs/guides/platforms/github-claims.md

@@ -39,7 +39,7 @@ Platform claim indexed: github @<username> -> did:keri:E...
 
 ### Custom registry URL
 
-By default, claims are submitted to `https://registry.auths.dev` (the public registry is not yet live). To use a different registry:
+Claims are submitted to the registry you pass with `--registry` — there is no default. Point it at our public registry (`https://network.auths.dev`) or one you run yourself:
 
 ```bash
 auths id claim github --registry https://your-registry.example.com

docs/sdk/rust/identity-operations.md

@@ -68,7 +68,7 @@ let config = DeveloperSetupConfig::builder(KeyAlias::new("work-laptop")?)
     })
     .with_git_signing_scope(GitSigningScope::Global)
     .with_conflict_policy(IdentityConflictPolicy::ReuseExisting)
-    .with_registration("https://registry.auths.dev")
+    .with_registration("https://network.auths.dev")
     .with_witness_config(witness_cfg)
     .with_metadata(serde_json::json!({"team": "platform"}))
     .with_sign_binary_path(PathBuf::from("/usr/local/bin/auths-sign"))