Valkyrie test harness - #58

The gem no longer depends on bolognese, removing 28 transitive gems.
DataCite's REST API accepts JSON directly, so the XML crosswalk had no
remaining purpose, and DOI autofill moves to doi.org content negotiation.

Metadata serialization and autofill now raise NotImplementedError until
their replacements land. The dependency floors also move up to match what
Hyrax 5.3 already requires: Ruby 3.2 and Rails 6.1.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Identifiers now live in their own table, one row per identifier per
resource, so a work can hold a DOI and a RAiD at once without either
overwriting the other. Each row tracks its own provider state, sync time,
and whether we minted it or someone supplied it.

Hyrax's identifier interface assumes a single overwritable attribute and a
bare string return, which leaves no room for state, errors, or additional
schemes. Registrars now return a result object, and providers are looked
up by scheme rather than hardcoded to DataCite.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Work types now carry DOI fields as Valkyrie attributes, and a work type can
hold its DOI in an attribute other than doi via holds_doi_in. Solr indexing
covers the DOI, the depositor's intent, and the state the provider reports.

doi_status_when_public now records intent only; what DataCite currently says
lives on the identifier record, because state is provider-specific
vocabulary. Where a repository already declares the attribute the gem leaves
it alone, since redeclaring would make the gem unloadable there.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Adds a rake task that installs the doi properties into the current m3
profile, and a validator that warns when a profile would leave DOIs
invisible on the show page or attached to no work type. The task creates a
new profile version rather than editing the current one, since saved works
pin their schema version to a row id.

Also adds a freyja test target: dassie with VALKYRIE_TRANSITION=true, the
only configuration with Wings loaded. It covers applications midway through
migrating off ActiveFedora, and immediately caught an rspec-rails API that
differs on the Rails 6.1 app.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Credentials now reach a registrar per instance, resolved through a store the
host application configures. The default reads them from the environment;
a multi-tenant host replaces it to source them per tenant. A connection test
confirms both that DataCite answers and that the credentials work, without
minting anything.

Credentials were class attributes, which are process-wide, so two Sidekiq
threads serving different tenants could overwrite each other mid-flight. The
store also describes its own fields, so a form can render itself from that
rather than hardcoding them.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

A serializer turns a work into DataCite REST v2 attributes. Which work field
feeds which DataCite field is read from datacite_mapping on m3 profile
properties, so an adopter can change it without a deploy, and it reports
which required fields a work still lacks.

Some values cannot be read from a field at all: a repository without a
creator field has to derive creators from its typed-role contributors. Those
come from a configured extractor, which takes precedence over the mapping.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Registering a DOI is now one idempotent request carrying the state we want.
DataCite's REST API takes an event — register, publish, or hide — so a work
intended to be findable while still private is hidden rather than published:
it resolves for anyone holding the DOI without being publicly indexed.

Registering returns the state DataCite reported, along with any field-level
errors, and missing required metadata is named before the request goes out.
The legacy MDS API needed three calls whose combined side effects determined
the state, including a delete that existed only to undo the other two.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Whether a work should get a DOI now lives in a policy object the registrar
consults, so a repository can limit minting to particular work types without
the registrar knowing about that choice. A work type qualifies by naming a
registrar, which is what including a scheme concern does.

The checks were three predicates inlined in the registrar, which left no way
to restrict minting without editing it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Adds a mint endpoint requiring edit permission on the work, and a helper that
decides whether to offer the button on a show page. Both minting endpoints
are POST and return JSON, since reserving an identifier has a side effect at
DataCite that a browser prefetch must not be able to trigger.

The gem also registers its own registrar now. Hyrax ships an empty registrar
hash and its generator only writes one into a host initializer, so a skipped
generator left minting silently unavailable.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Rewrites the DOI tab off inline jQuery onto a delegated vanilla-JS asset, and
adds the mint button as a show-page action. The tab's autofill handler used the
jquery-ujs event signature while the stack ships rails-ujs, so the DOI was
never sent; the missing-field warning looked for a hardcoded creator selector
that matches nothing in a repository without that field.

The engine now wires its own helpers. The tab previously appeared only if the
adopter ran the install generator, and its work-type check read class ancestry,
which a flexible-metadata profile does not touch.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Replaces the actor stack with a publisher listener that syncs metadata for
works that already have a DOI. Editing a work without one still mints nothing.

It also listens for permission changes, not just metadata saves: embargo and
lease release change visibility without saving metadata, so a work meant to
become findable would otherwise stay registered indefinitely after release.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Autofill now works: paste a DOI and the form populates from the metadata its
publisher registered. Reading is separate from minting, so a DOI recorded this
way is marked external and never has metadata pushed back to it.

Metadata comes from doi.org content negotiation as CSL JSON, so any
registration agency resolves rather than DataCite alone — a journal article's
CrossRef DOI is the common thing a depositor pastes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Adds a renderer that links a DOI to its resolver, and withholds draft DOIs —
a draft is reserved but does not resolve, so linking one gives readers a dead
link.

Drops a copy of Hyrax 2.9's attribute markup that the gem carried to add its
one row. Hyrax now builds that list from each field's own profile settings, so
the copy was quietly overriding every work type's configured display.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Rewrites the remaining pre-Valkyrie specs against Valkyrie resources, or drops
them where a Valkyrie spec already covered the same ground. All of them were
excluded from every run, so none had executed since the port began, and each
referenced code this rewrite has since removed.

Two gaps came out of it: the form and presenter concerns had no live coverage
at all, and the shared examples the gem ships for adopters were still asserting
ActiveModel validations that a Valkyrie resource does not have. The suite now
runs those examples so they cannot drift again.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Installing raised on boot from registrar settings that no longer exist. The
work-type generator looked for class declarations Valkyrie work types do not
have, so it reported success while changing nothing. The migration generator
raised before writing anything.

Installing now also creates the identifier table, rather than leaving a step an
adopter hits later as a missing-table error on first mint.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Removes a helper module nothing includes any more, and which would misbehave
if something did: the engine prepends both helpers it bundles, so including it
would shadow Hyrax's own methods instead of wrapping them.

Also drops rubocop exclusions naming five deleted spec files, and corrects the
gemspec, which claimed MIT and packaged a license filename this repo has never
had. The license is Apache 2.0, as the LICENSE file, the README badge, and
every other Samvera project have it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Rewrites the README around explicit minting, which is the behavior most likely
to surprise someone expecting the old automatic version, and adds a
configuration guide covering credential stores, minting policy, and the
flexible-metadata setup.

Drops two guides written for Hyrax 2.9 whose steps referenced code this
rewrite removed. Nothing linked to either.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Swaps the CircleCI badge for the GitHub Actions workflow. CircleCI still
serves an image for projects it no longer builds, so the old badge looked like
a passing build while reporting on nothing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The web and worker containers share two volumes and both create the same
directories in them at boot, so starting the pair raced and one died before any
specs could run. Specs enqueue with the test adapter and need no worker.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Lowers the Hyrax floor to 5.2. The 5.3.0 version bump lives on a release commit
that was never merged back, so Hyrax main ships the flexible metadata stack
while still declaring 5.2.0 — and a 5.3 floor made the gem unresolvable for
every application tracking main, Hyku included.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The generated migration declared CreateHyraxDoiPersistentIdentifiers, but the
engine registers DOI as an acronym, so Rails camelizes the filename to
CreateHyraxDOIPersistentIdentifiers and db:migrate raised NameError. The
generator's own spec had the wrong spelling too, so nothing caught it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The autofill, reserve-a-DOI, and mint buttons now build their URLs from the
mounted engine, so they reach the application's own mount point instead of a
path nothing serves. Saving a work with a minting choice no longer fails on
`undefined method 'embargo' for an instance of String`. The install generator
reports when it cannot add the mount rather than claiming success, and the
README says how to add it by hand.

Three faults with one shape -- something worked in the suite but not in an
application. Engine.routes.url_helpers builds paths against the engine's own
route set and ignores the host's mount point; only feature specs mounted the
engine, so no view spec could catch it. The form's sync returned the value an
attribute writer hands back rather than the resource, which Hyrax's save step
then asks for an embargo. The engine is now mounted for the whole suite, and
the shared form examples assert what sync returns.

"Reserve a DOI now" now shows the identifier in a field of its own beside the
button, with a copy button, and saves it with the work. Reserving a DOI early
exists so it can be pasted into a document before that document is uploaded,
so the depositor has to be able to read and copy it.

The reservation was written into the existing-DOI input, which sits in a
different mode panel: the depositor saw nothing but a disabled button, and
because the minting mode discards that panel's value, the DOI was created at
DataCite and then dropped when the work saved. The copy button falls back to
selecting the text where navigator.clipboard is unavailable.

A work saving with a DOI reserved before it existed now claims that identifier
record, so DataCite receives the work's metadata instead of keeping a draft
that has nothing but a prefix. Describing a DOI a work already holds no longer
requires a minting choice, while creating one still does -- a work type an
operator excluded from minting is never touched either way.

The reservation was recorded before the work existed and so carried no
resource_id; nothing linked the two afterwards, so no sync ever ran and the
orphan sweep would have counted a DOI that was in use. Hyrax::DOI.config is
also reset between examples now: specs that set a restrictive policy leaked
into everything after them, which is what four order-dependent failures here
turned out to be.

Reserving a DOI now sets the work's minting intent to draft, so the work agrees
it holds a reserved identifier. Nothing submits until the reservation actually
succeeds, and a status the depositor picks afterwards still wins.

A reserved DOI with a blank intent left the work holding a real identifier
while claiming to want none. doi_status reported nothing, so the renderer could
not tell a draft from a resolvable DOI and would have linked one that does not
resolve; the show-page mint button requires an intent, so it was hidden, which
left no route to promote the DOI at all.

Choosing Draft, Registered, or Findable on the deposit form now creates the DOI
when the work is saved, and records the identifier so later edits keep DataCite
current. A work type the minting policy excludes still mints nothing, and
editing a work that asked for no DOI still creates none.

The intent was recorded and nothing acted on it: the listener enqueued a sync
only for a work that already had an identifier record, and the job returned
early without one, so no DOI was created and no result was written back. A
reserved DOI also moves to its own form parameter -- it shared doi[] with the
existing-DOI field, so the reconciliation that drops a value left behind in an
unselected panel could not tell the two apart and discarded an identifier that
already existed at DataCite.

A registered or findable DOI is only created when the work carries the metadata
DataCite requires. Blank required fields are named for the depositor to fill,
and the deposit form says plainly that no DOI will be created until they are.
A sync job also mints at most one DOI however many times it runs.

The serializer substituted DataCite's :unav sentinel for a blank creator or
publisher, the current year for a missing publication year, and Other for a
missing resource type -- then reported those same fields as absent, so the
registrar refused to mint and the placeholders were discarded while the form
promised they would be sent. Minting decided from the absence of an identifier
record, which is written only after the provider replies, so a duplicate
enqueue or a retry each saw nothing and each created a permanent identifier.