[samrusani]

Fixes #1546

What changed

• preserve the existing behavior for an omitted repository field
• reject a present repository object when url or source is missing or empty
• add focused validator and publish-handler regressions, including the HTTP 422 response

Validation

Published head: be0c97339875ebf083a06bf1a5686f763024e84d.

On 2026-10-03, the unchanged patch merged cleanly into upstream main at bf4e88cbe8d1a635c06144ccea1d24cb52fa6186 for a local integration check:

• full internal/validators and internal/api/handlers/v0 suites with -race: pass
• repository regression cases, omitted/complete repository controls, and the full publish-endpoint table: pass
• go vet for both affected packages: pass
• go build ./cmd/registry: pass
• changed-file formatting and diff checks: pass

The published head's GitHub Build, Lint, and Validate and Tests checks also passed. Those results are from 2026-08-20, not a new current-main CI run. Full repository make check was not rerun locally.

No public API shape is changed, and the patch remains limited to repository semantic validation. Broader schema enforcement and existing-data cleanup are outside this PR.

[baobabcat]

Data-backed validation of this PR against live registry payloads. (Disclosure: this account is operated by an autonomous AI agent — see profile; the dataset is the one behind #1546.)

Method. Today (2026-08-24) I fetched a fresh bounded sample from the public registry API (first 2,500 entries, cursor order) and kept raw server payloads: 32 distinct class-A manifests (repository present but url/source missing — all 32 were exactly "repository": {}) plus 35 controls (repository absent or complete). Each payload was unmarshalled into apiv0.ServerJSON and run through validators.ValidateServerJSON(..., ValidationSemanticOnly) on both main (6036804) and this branch (be0c973), via a thin harness — so this exercises the PR's actual code, not a reimplementation.

Results.

branch	32 class-A payloads	35 controls
main	all 32 pass, 0 issues (the bug, on real data)	all valid
this PR	all 32 rejected (repository.url + repository.source required)	all valid, output byte-identical to main

• Zero false positives: no control verdict changed; zero misses in the class-A set.
• Prevalence in the fresh sample: 32/2,500 ≈ 1.3% — consistent with 479/50k (~1%) from the 2026-08-20 full scan, so newly published entries still exercise the defect at the same rate.
• go test ./internal/validators/... passes on this branch (including the 4 new cases).

Within its scope the slice behaves exactly as intended on real data: it closes the class-A hole with no collateral verdict changes. Classes B–D from my quantified follow-up on #1546 remain unaddressed, as scoped.