Discover primary VOSpace services from registry records

[shinybrar]

Part of Integrate upstream vosfs and fsspec-cli as canfar data.

Blocked by

• Configure named VOSpace services for Science Platform Servers

Summary

Extend Science Platform Server discovery so each discovered server may gain one explicit primary VOSpace service from the same registry namespace. Never derive storage URLs from the Skaha URL.

Required behavior

• Retain relevant registry resource records instead of filtering only /skaha.
• Pair a Science Platform Server URI with a storage resource sharing its IVOA URI namespace.
• The built-in IDP catalog declares the preferred primary resource leaf: cadc → arc; srcnet → cavern.
• Use the exact registry URL, removing only the terminal /capabilities when storing the base endpoint.
• Validate that the selected resource exposes the required OpenCADC VOSpace capability shape before persisting it.
• Name the discovered primary storage with the Server Name.
• Preserve all manually configured storage entries; refresh only the generated primary entry with the same name.
• Do not automatically add CADC Vault or other secondary services in this release.
• In non-strict discovery, an absent, unreachable, or malformed storage service keeps the usable Science Platform Server and its existing storage configuration.
• In strict inspection, surface one actionable storage discovery error.

Acceptance criteria

• CADC registry fixtures containing both ARC and Vault select ARC.
• SRCNet fixtures pair each Skaha service with its same-namespace Cavern service.
• URL suffix similarity alone never creates a storage endpoint.
• Manual additional entries survive rediscovery.
• Missing/malformed/unreachable storage records follow strict and non-strict behavior above.
• Discovery output and persisted Configuration serialize the primary storage.
• Focused discovery tests, lint, type checks, and deterministic tests pass.

Out of scope

Secondary-service alias generation, interactive storage selection, credential materialization, filesystem construction, and CLI composition.

---

Amended 2026-07-25

The acceptance criteria above are preserved as originally written. The items
below changed after this issue was filed, at the maintainer's request, and
shipped in #217.

• CADC Vault is now a default. This supersedes "Do not automatically add
  CADC Vault or other secondary services in this release": both arc and
  vault ship as configured defaults on the CADC Server.
• Discovered storage is keyed by registry leaf, not Server Name. This
  supersedes "Name the discovered primary storage with the Server Name", so the
  CADC service is addressed as arc: rather than canfar:. Federated Servers
  keep Server-Name keying, since their leaves are not globally unique.

[shinybrar]

Unblocked: configuration prerequisite #151 is complete. This ticket is now ready for agent implementation from the reviewed configuration contract.

[shinybrar]

In flight on feat/vosfs-registry-records, based on epic branch feat/vosfs-support. Implementation uses GPT-5.6 Sol Medium with ponytail ultra and a fixed-base ticket review.

[shinybrar]

Implementation is ready for human review in #219.

• Branch: feat/vosfs-registry-records
• Head: 9fcfde93f8779f56a5b8ab7ede7eef642ce0333f
• Base: updated feat/vosfs-support at 8ecdabed
• Fixed-base spec review: clean; confirmed the required primary Storage Name uses the Server Name string while remaining a distinct VOSpace Service identity.
• Fixed-base standards review: test configuration isolation and glossary wording findings fixed in the final branch. The optional enrichment sentinel was retained as the minimal strict/non-strict distinction between inspection not requested and an explicitly absent preferred registry record.
• Ruff and format: pass.
• Deterministic tests: 775 passed before rebase.
• Post-rebase focused tests: 175 passed.
• Type gate: exactly the accepted 22 pre-existing unused-ignore diagnostics; no new diagnostics.
• MkDocs: completed. The git-committers contributor lookup reported a non-fatal GitHub API 403 rate-limit warning; the plugin and gate were not weakened.

No credential construction, filesystem source, CLI, packaging, or documentation behavior was added. Not merged.