Remove pallet-registry from runtime

[l0r1s]

Description

Removed the pallet-registry because it's not used in the codebase.

[github-actions]

AI review — see the sticky summary comment for the verdict and the inline comments below for specific findings.

[github-actions]

[HIGH] Removing Registry leaves existing identity deposits without a release path

Registry::set_identity previously placed balance holds under HoldReason::RegistryIdentity, and Registry::clear_identity was the release path. This PR removes the pallet and its RuntimeHoldReason variant without adding an OnRuntimeUpgrade migration to release any existing Registry holds or prove the storage is empty. Do not assume the public extrinsic was unused from codebase references alone; if any account used it on-chain, its held deposit can become inaccessible or otherwise mishandled after the upgrade. Add a migration/try-state guard that handles Registry::IdentityOf and corresponding balance holds before removing the pallet from the runtime.

[github-actions]

🛡️ AI Review — Skeptic (security review)

VERDICT: VULNERABLE

Baseline scrutiny: l0r1s has write permission, an established account, and substantial prior subtensor PR history; branch remove-registry-pallet -> devnet-ready.

No .github/ai-review/* or .github/copilot-instructions.md changes were present. The diff is deletion-heavy, but removing an on-chain pallet is still runtime state surgery and needs explicit upgrade handling.

Findings

Sev	File	Finding
HIGH	runtime/src/lib.rs:236	Runtime-affecting change does not bump spec_version	(off-diff)
HIGH	runtime/src/lib.rs:1573	Removing Registry leaves existing identity deposits without a release path	inline

Other findings

• [HIGH] Runtime-affecting change does not bump spec_version (runtime/src/lib.rs:236) — runtime/src/lib.rs:236 still reports spec_version: 417, but this PR changes the runtime composition, metadata, and dispatchable call set by removing pallet index 17. Runtime-affecting changes must bump spec_version; leaving it unchanged can cause nodes and clients to treat incompatible runtime code as the same version, which is a consensus/upgrade safety risk.

Conclusion

The PR is not malicious, but it is currently vulnerable because it removes a runtime pallet without a state/hold migration and without bumping the runtime spec_version. Both issues are runtime-upgrade hazards that should block merge until addressed.

---

# 🔍 AI Review — Auditor (domain review) has not yet run on this PR.

[github-actions]

🔄 AI review updated — Skeptic: VULNERABLE