feat: establish standalone Argand Site Registry

docs/TRUST.md

@@ -0,0 +1,63 @@
+# Trust and evidence policy
+
+## What the implementation enforces
+
+Inputs use reviewed source adapters and explicit manifests. URL normalization,
+PSL parsing and stable identities are deterministic. Fact provenance, conflicting
+evidence and source-specific popularity remain separate. Names and similar
+hostnames never silently join entities. Invalid URLs and malformed imports fail
+validation; a partial import does not replace a complete source selection.
+
+Destination and identity decisions bind exact evidence fingerprints, including
+names, assertions and normalization context. Reviews expire within 90 days.
+Changed evidence invalidates earlier approvals. Resolution abstains on ambiguity,
+ties, missing approval or ineligible claims; regional scopes must explicitly
+match. The local writer owns the append-only review log.
+
+Generations bind the database, license document and attribution to a completion
+receipt. Consumers provide a trusted hash or verify an external publisher key.
+Activation checks signatures and refuses rollback that loses distributed
+revocations. Updates build candidates and cannot approve, sign or activate them.
+
+## What a publisher must establish
+
+The reviewer name and evidence locator in a decision are operator assertions.
+The CLI validates their structure and evidence binding; it does not independently
+authenticate the reviewer, retrieve their evidence or prove website ownership.
+Protect the writer database and signing key with separate operating permissions.
+Restrict who can author decisions and require human review before release signing.
+
+Publish dated evidence supporting the exact entity, URL, relationship, role and
+country/locale. Prefer independently corroborated primary evidence with immutable
+capture identifiers. Record contrary evidence and uncertainty. TLS, DNS control,
+registrable-domain spelling, redirects, `sameAs` or popularity alone cannot
+establish every identity or role claim. Future crawler observations remain inputs
+to review. Confidence values are assertion scores, not calibrated probabilities.
+
+Choose expiry based on volatility, within the enforced maximum. Do not renew
+blindly on a timer. Expired approval should lead to abstention until evidence is
+reviewed. Disclose editorial conflicts and use an independent reviewer for a
+disputed claim when possible. The initial implementation is a local single-writer
+tool; it does not provide authenticated reviewer accounts or an enforced quorum.
+
+## What consumers must preserve
+
+Authenticate a release before opening it. Keep the full receipt pin and required
+attribution with caches and exports. Use `resolve` for reviewed destinations, keep
+null as abstention, and enforce application-specific malware/content/navigation
+policy separately. A verified signature authenticates the publisher, not the truth
+of every assertion. An official website may later be compromised.
+
+Deliver revocations to every active consumer and derived catalogue, and bound cache
+lifetimes. The resolver checks review expiry at query time; a detached cached URL
+does not recheck itself. Preserve the current review history during rollback.
+Copying SQLite rows or the JSONL export into a second resolver can bypass these
+checks; use the native API or CLI for admission decisions.
+
+## Community changes
+
+Treat public submissions as untrusted evidence. Do not execute submitted content
+or copy review decisions into production automatically. Source allowlist and
+attribution changes need both implementation tests and documented rights review.
+Reject unknown sources until those checks are complete. Every publisher may apply
+stricter admission rules, and must state its actual review and incident procedures.