ConnectorManifestRegistry

The ConnectorManifestRegistry is the engine that makes 'a connector' a deterministic, declarative thing instead of a wad of glue code. Each connector ships a YAML manifest listing its action templates, their risk-lock ceilings, their MITRE techniques, and the events the connector emits. The registry is the source-of-truth every other engine consults.

The AuthorityBridge reads the risk-lock from here when computing the ceiling. The MitreCoverage engine reads the technique list from here when computing coverage. The IngestPipeline reads the connector's event shape from here when constructing the normalizer. Centralizing this in one validated registry means a manifest typo can't silently break the bridge OR the coverage map OR the ingest — the typo fails the engine at boot, before serving any traffic.

Manifest validation also enforces the version compatibility contract. A connector pack v2.x that depends on engine features v1.x doesn't load — the registry surfaces the version mismatch as a clean boot error instead of a runtime crash during the first incident.

On engine boot the registry walks `connectors/manifests/*.yaml`, parses each with the strict pydantic schema (`ConnectorManifest`), and indexes the result by connector slug. A malformed manifest (missing required field, invalid risk_lock value, unknown action_template_id format) raises at boot — the engine refuses to come up rather than serve a half-broken state.

Validated manifests are exposed via `registry.get(slug)` and `registry.all()`. Every consumer treats the result as read-only — there is no `set()` API and no dashboard write surface. Manifest changes ship as part of the binary; runtime modification of a manifest would defeat the validation guarantee.

The registry also enforces the connector-tier rule. Each manifest declares `free_tier: true|false`; the registry exposes a filtered view that the dashboard's /connectors page uses to gate Pro-only connectors behind the license tier. A Free install that tries to enroll a Pro-only connector hits a typed `TierMismatchError` from the runtime gate, not a 'connector not found.'

The marketing site's /connectors per-slug pages pull the same manifest data the engine uses (via the `component_inventory.json` dump). What the brochure says a connector does is what the engine knows the connector does. No drift between sales and reality.

Stable — the schema has been frozen since 2026-04-22. The 27 shipping connector manifests + 8 doctrine-only manifests all validate clean on every boot. Schema validation is the test suite's first gate; a PR that breaks any manifest can't merge.

Shipped 2026-06-07 (API + thread-safety half): `ConnectorManifestRegistry.swap_manifest(new)` atomically replaces ONE manifest's registration under an internal RLock. Returns the previous manifest (or None) so the caller can diff-log the change. Same license-gate semantics as register() — gated swaps raise and leave the registry untouched. get_manifest() now reads under the lock so concurrent readers see either pre or post state, never a missing-key error. The config-watcher that calls swap_manifest on manifest-file mtime change ships in v1.x — that closes the bug-fix-without-redeploy loop.

Known limit: there's no per-tenant override yet. A multi-tenant install (v1.5 + Sovereign) where tenant A wants a custom action template on top of a shared manifest will need a per-tenant overlay layer that lands with federation.