[kelvinprabhu]

Summary

Closes #118.

Adds a reusable providerstatus step plugin to the network adapter to prevent inactive or unregistered providers from publishing catalogs or appearing in discover results.

• Publish: Only active registry providers can publish. Invalid providers are rejected with HTTP 400.
• Discover: Filters results to active providers. Inactive or unknown providers are excluded without deleting their catalogs.
• Fail closed: Registry failures or invalid/empty active-provider lists reject publishes (500) or return no discover results.
• Action validation: Uses the URL path as the source of truth; mismatched body actions are rejected.
• Registry integration: Adds RegistryStepProvider so step plugins can access the registry.

Configuration: The plugin is registered but not enabled in any config. Enabling it requires a separate Helm charts change.

Compatibility: No existing lines removed; existing configurations remain unchanged.

[github-actions]

🛡️ Trivy security scan (CRITICAL,HIGH,MEDIUM,LOW)

View full run

Go dependencies

No findings at CRITICAL,HIGH,MEDIUM,LOW.

Container image

No findings at CRITICAL,HIGH,MEDIUM,LOW.

[github-actions]

📊 Test Coverage: ✅ Passed — 86% of changed lines covered, min 80%

[kelvinprabhu]

Rollout

1. Merge this, build the plugin set.
2. In the helmcharts repo, enable it in the network module only:

plugins:
  registrySteps:
    - id: providerstatus
steps:
  - validateSign
  - providerstatus
  - addRoute

The module path is / in multi-adapter and /_internal/network/ in single-adapter, so both modules need it.

Before step 2: the catalog crawler's retire publish (catalogcrawler/internal/sink) sends a body with no provider, which this gate would reject, and the sink retries a rejected publish indefinitely. Add provider.id to that body first.