How do I add a domain service?

1. Question
2. Answer
3. Who reads the registry
4. Script
5. Tested by
6. See also

The list of NATS domain services has a single source of truth: the service registry, a ores.codegen model. Everything else is derived from it — never hand-maintain a service list anywhere else, and never infer the service set from the projects/ directory layout.

1. Question

How do I add (or remove) a NATS domain service so that its database user, roles, grants, generated shell vars, and .env credentials are all created consistently?

2. Answer

Edit the registry — the one authored source, a literate org model:
```
$EDITOR projects/modeling/service_registry.org
```
Add (or remove) a service as a top-level heading (* <name>) with the per-service properties (psql_var, env_key, iam_role, description, email) and its DML prefixes (the ores_<name>_* tables it owns); Select prefixes for cross-service reads.
Regenerate the artefacts the registry drives via the service-registry codegen profile (see How do I run codegen? for the current invocation). This (re)writes projects/ores.sql/service_vars.sh (SERVICE_NAMES) and the SQL for service users, accounts, roles, and DB grants.
Regenerate credentials so the new service gets its .env entries (ORES_<NAME>_SERVICE_DB_USER / _PASSWORD / _DATABASE):
```
./projects/ores.compass/compass.sh env configure --preset <preset> -y
```
Recreate the database to provision the new role and grants:
```
./projects/ores.compass/compass.sh db recreate -y
```
Commit the registry edit and all regenerated files together.

3. Who reads the registry

Consumer	How
`projects/ores.sql/service_vars.sh` (`SERVICE_NAMES`)	generated by the `service-registry` profile
SQL service users / accounts / roles / grants	generated by the same profile (4 templates)
`compass env configure`	reads the registry to emit per-service `.env` credentials
`projects/ores.lisp/src/ores-prodigy.el`	derives the launch list from `ORES_*_SERVICE_DB_USER` in `.env` (downstream of `compass env configure`)

http_user and compute_wrapper_user are intentionally not in the registry — those roles are provisioned by the hand-written SQL in projects/ores.sql/setup_user.sql, not by the service-registry profile.

4. Script

Generation: ./compass.sh codegen generate --model projects/modeling/service_registry.org --address ores.shell.service. Credentials: compass env configure. Provisioning: compass db recreate.

5. Tested by

Manual: after step 2, git diff projects/ores.sql/service_vars.sh shows the new SERVICE_NAMES entry; after steps 3–4 the new ORES_<NAME>_SERVICE_DB_* vars exist and compass db recreate reports no missing-password errors. CI exercises the same path in the canary "Setup Database" step.

6. See also

ores.codegen — the generator and its profile catalogue.
Model Assisted Software Development — the model→artefact transformation the registry is an instance of.