# Registry upgrades

Source: /tuil/docs/guides/registry-upgrades
Locale: en

Verify provenance, compatibility, locks, and codemods.



Registry items declare package version, integrity, compatibility, deprecation,
ordered codemods, and an ownership mode: `source`, `package`, or `plugin`.
Published HTTP registries must provide version, SHA-256 integrity,
`compatibility.tuil`, supported renderers, provenance, and ownership. Package-
and plugin-owned items also identify their package. Missing or tampered metadata
is rejected before dependency resolution or file writes.

The registry index carries the same release, ownership, compatibility,
deprecation, codemod, dependency, provenance, and file-descriptor metadata as
the item manifest. This lets search and upgrade tooling diagnose an item before
downloading its source. After resolving an item, verify its complete canonical
manifest and compatibility, apply codemods, and add provenance comments.
Persist a lock entry for the resolved identity, source, package, dependency
graph, version, and checksum. Use frozen-lockfile verification in repeatable
builds.

Review generated changes like application code. A codemod must be deterministic
and idempotent; an incompatible item is an error, not a best-effort install.