Discovery & Registration

ContextUnity separates service discovery from Router project registration.

Service Discovery

Services may still publish network endpoints through the discovery layer so other services can find them without hardcoded addresses.

from contextunity.core import register_service

register_service(
    service="brain",
    instance="pod-123",
    endpoint="brain-service.internal:50051",
    tenants=["project-a", "project-b"],
    metadata={"version": "1.0"},
)

Consumers resolve service endpoints through the SDK/client configuration layer.

Router Registration SSOT

RegisterManifest writes the Router source of truth under:

Key	Content
`router:registrations:{project_id}`	Full validated registration bundle
`router:registrations:{project_id}:hash`	Manifest bundle hash

project_id is the owner/identity. allowed_tenants is the security scope. A single-tenant v1alpha8 manifest omits project.allowed_tenants, and the SDK defaults it to [project.id].

Runtime Key Sources

HMAC bootstrap and prompt integrity: CU_PROJECT_SECRET.
Session-token public keys: Shield.
LLM provider keys: provider env/config or Shield secrets.
Federated tool allowlists: graph-scoped federated:* references and template toolkit expansion.