Publish first signed Site Registry catalog trust

docs/CONSUMERS.md

@@ -101,12 +101,15 @@ revocation history. Never mutate a complete generation to migrate it. See
 ## Argand integration
 
 `UPSTREAM.json` records the original Argand extraction baseline and file hashes.
-The last recorded downstream integration replaced Argand's embedded crate with
-signed v0.3.0 revision `ac8282093d8a815c6227cff86e1f40714d510bcd` at Argand
-commit `d9dfd1585ce21d9c4136bcc24fa01fe3bfb8ed6e`.
+Argand pins signed v0.5.0 revision
+`3d3e08cdfd303df9fbd347a9bab2ba52ad575759`. The public beta uses Site Registry as
+Navigate's authoritative auto-route catalog. Its native `navigation-catalog/v2`
+file is only a collection- and content-policy-bound serving projection compiled
+from one exact registry generation; it is not a second independently curated
+destination catalog.
 
-Version 0.5 is handed off as a signed standalone revision. Argand should update its
-full Git `rev` in a separate coordinated source/build window, compare contract
-changes, and rerun navigation compiler, native resolver, API, abstention,
-revocation and clean-process gates. Changing the code dependency does not activate
-a registry generation or approve a public destination.
+Argand source commit `564ee5fc2fa0974a7b0557a914f274bbd4ab654c` records that boundary and the first
+public-beta activation. Changing the code dependency alone still does not activate
+a data generation or approve a destination. Every downstream must verify the
+signed generation, preserve abstentions, apply its own safety policy, and bind any
+serving projection to its own eligible corpus or directory policy.

docs/INDEX.md

@@ -8,6 +8,7 @@
 - [Migrating to 0.4](MIGRATING-0.4.md): writer migration and trust transition.
 - [Source licenses](../crates/argand-site-registry/LICENSE_SOURCES.md): exact terms and attribution.
 - [Consumers](CONSUMERS.md): Rust, Python/CLI, data distribution and Argand transition.
+- [Public catalog](PUBLIC_CATALOG.md): download, independent trust roots, verification, scope and refresh contract.
 - [Trust](TRUST.md): enforced checks and publisher/consumer responsibilities.
 - [Publishing](PUBLISHING.md): reviewer keys, candidate acceptance and activation.
 - [Evaluation](EVALUATION.md): bounded JSONL judgments and result interpretation.

docs/PUBLIC_CATALOG.md

@@ -0,0 +1,62 @@
+# Public signed catalog
+
+The v0.5.0 Forgejo release publishes the first immutable data generation that any
+Site Registry consumer can verify and resolve:
+
+- release: <https://git.argand.org/nicweyand/argand-site-registry/releases/tag/v0.5.0>
+- asset: `argand-site-registry-catalog-20260920-v1.tar.gz`
+- asset SHA-256:
+  `d878fa057397effa5dc729d2fa3a689c8edd1f4112ef1326dd6131b3fdeab63e`
+- generation pin:
+  `ede14746da8817aafdf705dd88cfeabbe8d23e1991e43a304acd8eca9249b18a`
+
+The release also carries a checksum file and an OpenSSH signature under namespace
+`argand-site-registry-release`. Verify it against
+[`trust/public-catalog-20260920/publisher-allowed-signers`](../trust/public-catalog-20260920/publisher-allowed-signers).
+The signed Git history is the independent channel for the trust root; do not learn
+the only trusted key from the archive it authenticates.
+
+```bash
+sha256sum --check argand-site-registry-catalog-20260920-v1.tar.gz.sha256
+ssh-keygen -Y verify \
+  -f trust/public-catalog-20260920/publisher-allowed-signers \
+  -I argand-site-registry-publisher-v1 \
+  -n argand-site-registry-release \
+  -s argand-site-registry-catalog-20260920-v1.tar.gz.sig \
+  < argand-site-registry-catalog-20260920-v1.tar.gz
+```
+
+After extraction, verify every member with `SHA256SUMS`, then authenticate the
+generation and exact reviewer trust root:
+
+```bash
+argand-site-registry activate \
+  --generation public-release-v0.5.0/catalog \
+  --current current.json \
+  --allowed-signers trust/public-catalog-20260920/publisher-allowed-signers \
+  --allowed-reviewers trust/public-catalog-20260920/reviewer-allowed-signers \
+  --identity argand-site-registry-publisher-v1
+
+argand-site-registry resolve \
+  --generation public-release-v0.5.0/catalog \
+  --pin ede14746da8817aafdf705dd88cfeabbe8d23e1991e43a304acd8eca9249b18a \
+  --query "yahoo mail"
+```
+
+## Scope and trust
+
+This first catalog is deliberately small. Its disclosed policy uses one automated
+evidence-gate reviewer group rather than claiming human-review quorum. Fresh exact
+endpoint observations are required, and source conflicts or dangerous drift need
+two groups, so the single automated reviewer must abstain on those risks. Sticky
+revocations and publisher/reviewer key separation remain enabled.
+
+Consumers decide whether this policy is appropriate for their use. Preserve typed
+abstentions, retain attribution, and apply independent malware and content policy.
+Do not route to the first raw lookup result. High-risk or disputed catalogs should
+use the unchanged two-human-reviewer reference policy.
+
+The generation's approvals expire. Installing an immutable archive is not a promise
+that every decision stays valid forever: use the resolver's requested time,
+consume cumulative signed revocation feeds when published, and move to a newly
+signed full generation before relying on renewed decisions.