Organizations & access

Organizations and namespaces

Every artifact lives under a namespace — the part before the / in <namespace>/<catalog_id>. A namespace belongs to an organization; browse them all from Organizations, and each organization's page lists the artifacts it publishes.

Who can publish where

Publish authority is per-namespace. You can publish to a namespace if you are a member of the organization that owns it, or — for Gemara artifacts — if you hold the matching write:<Type> role. For evaluators, publish requires ownership of the namespace you publish to. Yanking is reserved for organization and hub admins — see Verifying & trust.

Requesting access

Reading needs no account. To publish, request access or sign in — new users are onboarded into an organization, after which publishing works with grcli / pvtr or trusted CI.

Trusted publishers

An organization admin can register a CI repository as a trusted publisher, mapping a GitHub Actions workflow identity to a namespace. That repository can then publish from CI with no stored secret — its OIDC token is the credential. This is the recommended path for automated releases.