feat: establish standalone Argand Site Registry

GOVERNANCE.md

@@ -0,0 +1,30 @@
+# Governance
+
+Nic Weyand is the initial code maintainer. Maintainers review implementation,
+dependency, format, provenance and source-license changes. There is no established
+multi-party review board or centrally operated public dataset implied by this repo.
+Maintainer additions and changes to this policy should be reviewed in public Git
+history, with conflicts of interest disclosed.
+
+Dataset publishers operate independently. Each publisher names its reviewers,
+publishes its evidence and review policy, and distributes trusted signing keys
+through a channel separate from the dataset. Consumers decide which publisher
+identities they accept. Code-maintainer status does not grant authority to change
+a consumer's accepted destinations or signing keys.
+
+Policy, license, normalization, source-allowlist and signature changes receive
+explicit maintainer review and complete acceptance checks. Additional independent
+review is appropriate for trust-boundary changes when another qualified reviewer
+is available. This is a governance expectation; the current software does not
+enforce a multi-reviewer quorum or authenticate a free-text reviewer name.
+
+Corrections and appeals must identify the exact assertion or review fingerprint
+and supply contrary evidence. Retain the original claim and decision, append the
+correction or revocation, and explain its scope. Urgent suspected malicious
+destinations may be revoked pending investigation. A release signer must not hide
+revocations by selecting an old generation.
+
+No payment, source popularity or contributor reputation buys destination approval.
+Repeated deceptive submissions can be rejected while their supporting incident
+record remains available to affected publishers. Avoid public exposure of secrets
+or personal information when documenting abuse; follow SECURITY.md.