chore(bios): vendor the registry from emu-atlas and drop the in-tree generator (#1543)

The BIOS registry's home is now
[emu-atlas](https://github.com/danielcopper/emu-atlas) — the data there
is byte-identical and the generator was ported at parity — so this repo
stops carrying both halves of the ownership.

- `scripts/generate_bios_registry.py` is deleted; regeneration happens
upstream (emu-atlas `scripts/` + its data README document the
procedure).
- `defaults/bios_registry.json` stays exactly where runtime code and
packaging expect it, but is now a vendored artifact:
`defaults/README.md` records provenance (emu-atlas release `v0.1.0`) and
the update procedure (fetch at a tag via the raw URL — atlas releases
carry no binary assets, the tagged tree is the artifact), and
`defaults/bios_registry.json.sha256` pins the bytes. CI and the mise
lint task verify the checksum alongside the existing gavel-native gate,
so a hand-edit or silent swap fails the pipeline.
- No runtime changes: `FirmwareService`, `domain/bios.py`, the load
path, and the release-zip smoke test are untouched.

Closes #1541.

Author: danielcopper

.github/workflows/ci.yml

@@ -169,6 +169,12 @@ jobs:
       # update when pulling a newer romm-gavel release).
       - name: Check vendored gavel native core checksum
         run: cd py_modules/native && sha256sum -c libgavel-x86_64-linux.so.sha256
+      # The BIOS registry ships in the plugin zip and is vendored verbatim from an
+      # emu-atlas release — there is no in-tree generator. A hand-edited snapshot
+      # must fail CI. Verify the vendored data against its checksum (bumped only by
+      # a deliberate defaults/README.md update when pulling a newer emu-atlas release).
+      - name: Check vendored BIOS registry checksum
+        run: cd defaults && sha256sum -c bios_registry.json.sha256
 
   # Skipped when SONAR_TOKEN is structurally unavailable: Dependabot PRs and
   # PRs from forks (GitHub withholds secrets from `pull_request` runs whose head

CLAUDE.md

@@ -244,7 +244,12 @@ in [`_vendor/README.md`](py_modules/_vendor/README.md). Compiled binaries (no so
 `py_modules/native/` instead (inside one of the fixed directories the Decky CLI packs into the plugin zip) — downloaded
 verbatim from an upstream release with a pinned SHA-256 (CI re-verifies it; the release smoke test asserts the artifact
 ships in the zip), loaded by an adapter via `ctypes` with no Python fallback; provenance and the update procedure live
-in [`native/README.md`](py_modules/native/README.md).
+in [`native/README.md`](py_modules/native/README.md). Vendored **data** (no source in this repo) follows the same
+discipline: `defaults/bios_registry.json` is copied verbatim from an
+[emu-atlas](https://github.com/danielcopper/emu-atlas) release with a pinned SHA-256
+(`defaults/bios_registry.json.sha256`, CI-verified via `mise run gate`; the release smoke test asserts it ships in the
+zip) — never hand-edit it, regeneration happens upstream; provenance and the update procedure live in
+[`defaults/README.md`](defaults/README.md).
 
 **Process boundaries — `main.py` vs `bootstrap.py`**: `[ours]` `main.py` owns the Decky lifecycle (`_main`, `_unload`)
 and the callable surface (one `async def` per `@callable`). `bootstrap.py` owns adapter instantiation and service

defaults/README.md

@@ -0,0 +1,53 @@
+# Packaged defaults
+
+Reference data that ships inside the plugin. The Decky CLI flattens this directory into the plugin root at package time,
+so the runtime reads these files by their bare name (no `defaults/` prefix); do not move or rename them.
+
+## `bios_registry.json` — vendored from emu-atlas
+
+The BIOS registry: which firmware files each platform and libretro core want, with the hashes and sizes that identify
+them. Read at runtime by `FirmwareService` (via `domain/bios.py`) to classify what a platform needs and whether a local
+file is the right one.
+
+It is **vendored verbatim** from [emu-atlas](https://github.com/danielcopper/emu-atlas), where the registry and its
+generator now live:
+
+- **Upstream:** <https://github.com/danielcopper/emu-atlas>
+- **Release:** `v0.1.0`
+- **Upstream path:** `atlas/data/bios_registry.json`
+- **Checksum:** pinned in `bios_registry.json.sha256` (SHA-256)
+
+This repo carries only the data snapshot — there is no in-tree generator. Generation is a dev-time, offline step that
+lives upstream (emu-atlas `scripts/generate_bios_registry.py`, documented in emu-atlas `atlas/data/README.md`); it
+derives the registry from the libretro `libretro-core-info` and `libretro-database` checkouts. **Never hand-edit the
+data here** — a manual edit would silently diverge from the released snapshot and break the checksum gate.
+
+### How to update
+
+1. Fetch the registry at the release tag (emu-atlas releases carry no binary assets — the tagged source tree is the
+   artifact):
+
+   ```sh
+   curl -fL -o defaults/bios_registry.json \
+     "https://raw.githubusercontent.com/danielcopper/emu-atlas/<tag>/atlas/data/bios_registry.json"
+   ```
+
+2. Regenerate the pinned checksum and verify it (the bare filename keeps `sha256sum -c` working from within this
+   directory):
+
+   ```sh
+   cd defaults && sha256sum bios_registry.json > bios_registry.json.sha256 && sha256sum -c bios_registry.json.sha256
+   ```
+
+3. Bump the **Release** tag above.
+4. Re-run the firmware tests (`tests/services/test_firmware.py`, `tests/domain/test_bios.py`) — a `required` flag flip,
+   a removed entry, or a changed hash is a behavior change for consumers, so call it out in the PR description.
+
+The checksum is re-verified by CI (`.github/workflows/ci.yml`, mirrored in `mise run gate` / `mise run lint`) and the
+release smoke test asserts the registry ships in the plugin zip, so both a hand-edited snapshot and a dropped file fail
+the pipeline.
+
+## `config.json` — in-tree default
+
+The platform-slug map and other default configuration. Unlike `bios_registry.json`, this is maintained in this repo (not
+vendored) and carries no checksum gate.

defaults/bios_registry.json.sha256

@@ -0,0 +1 @@
+26b0ba5f9578b80542f780342e4d99e24aa7b0479a11186bf21dc32a9a5bdbfe  bios_registry.json

docs/architecture/backend-architecture.md

@@ -1157,6 +1157,24 @@ construction and is itself the `ResolveUploadConflictFn` seam (`services/protoco
   `domain.sync_action.resolve_upload_conflict` kernel is **not** a runtime fallback; it is retained as the differential
   oracle and the gavel-ladder-vector target in tests (`tests/adapters/test_gavel_native.py`), so the shipped binary is
   proven to match the same contract the Python kernel is held to.
+
+#### FirmwareService notes — the vendored BIOS registry
+
+The BIOS registry — which firmware files each platform and libretro core want, with the hashes and sizes that identify
+them — is the data `FirmwareService` reads (via `domain/bios.py`) to classify what a platform needs and whether a local
+file is the right one. It ships as `defaults/bios_registry.json` and is **vendored verbatim** from an
+[emu-atlas](https://github.com/danielcopper/emu-atlas) release, where the registry and its generator now live — there is
+no in-tree generator, and regeneration is a dev-time, offline step upstream (from the libretro `libretro-core-info` and
+`libretro-database` sources).
+
+- **What ships**: `defaults/bios_registry.json` (emu-atlas `v0.1.0`, upstream path `atlas/data/bios_registry.json`),
+  copied verbatim with a pinned SHA-256 checksum. Provenance and the update procedure live in
+  [`defaults/README.md`](https://github.com/danielcopper/decky-romm-sync/blob/main/defaults/README.md). The checksum is
+  re-verified by CI (`.github/workflows/ci.yml`, mirrored in `mise run gate`) and the release smoke test asserts the
+  registry is present in the plugin zip, so both a hand-edited snapshot and a dropped file fail the pipeline.
+- **Never hand-edit it**: a manual edit would silently diverge from the released snapshot and break the checksum gate. A
+  registry change lands by pulling a newer emu-atlas release, re-pinning the checksum, and bumping the tag in
+  `defaults/README.md`.
 - **Path resolution**: the `.so` is resolved relative to the adapter module (`__file__`), mirroring
   `sqlite_migrations.MIGRATIONS_DIR` — a fatal-load bundled resource must resolve identically in the installed plugin
   (`<plugin>/py_modules/native/…`) and in the repo checkout the real-`bootstrap()` test tiers run from, where the plugin

mise.toml

@@ -62,6 +62,7 @@ run = [
     "python scripts/check_lock_sync.py",
     "python scripts/check_markdown_links.py",
     "cd py_modules/native && sha256sum -c libgavel-x86_64-linux.so.sha256",
+    "cd defaults && sha256sum -c bios_registry.json.sha256",
 ]
 
 [tasks.gate]