Publish first signed Site Registry catalog trust
Some checks failed
Standalone registry checks / check (push) Has been cancelled

This commit is contained in:
Nic Weyand 2026-09-20 11:57:47 -04:00
commit 16c740a98f
Signed by: nicweyand
SSH key fingerprint: SHA256:2te+ycJIQON/Wo/dH6+ZkFSQ4HnHWpetV2azx9E65dQ
8 changed files with 121 additions and 13 deletions

View file

@ -101,12 +101,15 @@ revocation history. Never mutate a complete generation to migrate it. See
## Argand integration
`UPSTREAM.json` records the original Argand extraction baseline and file hashes.
The last recorded downstream integration replaced Argand's embedded crate with
signed v0.3.0 revision `ac8282093d8a815c6227cff86e1f40714d510bcd` at Argand
commit `d9dfd1585ce21d9c4136bcc24fa01fe3bfb8ed6e`.
Argand pins signed v0.5.0 revision
`3d3e08cdfd303df9fbd347a9bab2ba52ad575759`. The public beta uses Site Registry as
Navigate's authoritative auto-route catalog. Its native `navigation-catalog/v2`
file is only a collection- and content-policy-bound serving projection compiled
from one exact registry generation; it is not a second independently curated
destination catalog.
Version 0.5 is handed off as a signed standalone revision. Argand should update its
full Git `rev` in a separate coordinated source/build window, compare contract
changes, and rerun navigation compiler, native resolver, API, abstention,
revocation and clean-process gates. Changing the code dependency does not activate
a registry generation or approve a public destination.
Argand source commit `564ee5fc2fa0974a7b0557a914f274bbd4ab654c` records that boundary and the first
public-beta activation. Changing the code dependency alone still does not activate
a data generation or approve a destination. Every downstream must verify the
signed generation, preserve abstentions, apply its own safety policy, and bind any
serving projection to its own eligible corpus or directory policy.