feat: establish standalone Argand Site Registry

docs/superpowers/plans/2026-09-12-standalone.md

@@ -0,0 +1,37 @@
+# Standalone Site Registry Implementation Plan
+
+> **For agentic workers:** Use superpowers:executing-plans inline. No subagents or Argand worktrees.
+
+**Goal:** Produce a reusable standalone repository and verifiable source release.
+
+**Architecture:** Retain the registry and atomic helper as two workspace crates.
+Preserve runtime bytes and wire packaging, consumer examples and release gates
+around their existing APIs. Use an isolated build directory.
+
+**Tech Stack:** Rust, SQLite, Python 3.11 standard library tooling, OpenSSH, Forgejo Actions.
+
+### Task 1: Extract the verified baseline
+- [x] Verify signed Argand commit 47911062b00d87f215ba61c41965faf8a7f4b7f7.
+- [x] Export only `engine/crates/argand-site-registry` and `engine/crates/argand-atomic`.
+- [x] Write `UPSTREAM.json` with original path/blob/hash evidence and a two-crate `Cargo.toml`.
+- [ ] Prune the inherited lock with `cargo metadata --offline --format-version 1`; retain exact dependency versions.
+
+### Task 2: Make standalone use and trust policy concrete
+- [ ] Add root README, LICENSE, source-license entrypoint, CONTRIBUTING, SECURITY and governance docs.
+- [ ] Add Rust `examples/lookup.rs` and Python `examples/lookup.py` consumers of existing query contracts.
+- [ ] Run both consumers on the native fixture and compare full lookup outputs, including attribution.
+
+### Task 3: Package and verify source releases
+- [ ] Add deterministic source archive and verification commands in `scripts/source_release.py`.
+- [ ] Test determinism, dirty-tree refusal, no-clobber, tampering and unsafe archive members in `tests/test_source_release.py`.
+- [ ] Add `scripts/check.sh` and `.forgejo/workflows/ci.yml` using an isolated runner without release secrets.
+- [ ] Document explicit release signing, downstream pins and incident response in `docs/RELEASING.md` and `docs/TRUST.md`.
+
+### Task 4: Validate and land the bounded task
+- [ ] Run `cargo fmt --all -- --check`, `cargo check --workspace --all-targets --locked --offline`,
+  `cargo clippy --workspace --all-targets --locked --offline -- -D warnings`,
+  `cargo test --workspace --locked --offline` and strict `cargo doc`.
+- [ ] Build the native executable and retain the all-five-source CLI fixture outside the repo.
+- [ ] Rebuild/run tests from the release archive outside the original workspace.
+- [ ] Review every initial tracked file and dependency change, sign the local commit and release receipt.
+- [ ] Record exact validation, publication and Argand cutover state; release any coordination window.

docs/superpowers/specs/2026-09-12-standalone-design.md

@@ -0,0 +1,37 @@
+# Standalone Site Registry design
+
+The user approved continuing standalone packaging, release CI and public governance
+on 2026-09-12. Preserve the existing AGPL-3.0-or-later license and all data terms.
+
+Create a separate two-crate workspace containing the current registry and atomic
+file helper. Preserve Rust module boundaries and the existing source adapters,
+SQLite schema, receipt contracts, explicit reviews and regional resolution.
+Record the exact signed Argand baseline and original file hashes in UPSTREAM.json.
+Do not copy Argand history, deployment configuration, datasets or signing keys.
+The existing Argand checkout and shared build caches remain owned by the beta agent.
+
+A separate package is preferable to a permanent second implementation or a new
+hosted service: it reuses the existing contracts and runs locally. Extracting only
+the CLI would lose the reusable Rust API. Preserve both CLI and library, and prove
+non-Rust consumption through the JSON CLI without creating a second resolver.
+
+Ship a focused Cargo.lock, complete code license, beginner quickstart, native Rust
+and Python examples, contribution requirements, trust policy and incident/revocation
+procedure. Source releases come from an exact committed tree, with deterministic
+archives and hash receipts; signing is an explicit local release action. CI checks
+formatting, all targets, strict lints, tests, documentation and a native all-source
+fixture, and exercises the archive outside its Git checkout. No CI signing key,
+provider credentials, production runner or automatic dataset promotion is included.
+
+Keep Argand's current consumer operational. Until an independently hosted release
+is accepted into Argand, its embedded copy remains the active consumer; document
+the cutover and verify baseline parity. The initial standalone package has no
+runtime behavior changes. Each dataset publisher chooses its own external trust
+roots; review policy is public and cannot be replaced by popularity or hostname
+similarity. An authenticated release is not proof of source accuracy or malware safety.
+
+Acceptance: preserve upstream Rust/schema bytes; build with only this workspace;
+run the complete two-crate offline gates plus fresh CLI and Rust/Python examples;
+produce the same source archive twice; reject modified releases, unsafe paths and
+release overwrites; inspect the initial Git inventory for private/unrelated content.
+Remote publication and runner activation are separate from local package readiness.