nicweyand/argand-site-registry
1
0
Fork 0
Code Issues Pull requests Projects Releases 7 Packages Wiki Activity Actions

release: implement site registry v0.5
All checks were successful
Standalone registry checks / check (push) Successful in 5m58s
Details

Browse source
This commit is contained in:
Nic Weyand 2026-09-13 14:42:39 -04:00
commit 557ba7cd69
Signed by: nicweyand
SSH key fingerprint: SHA256:2te+ycJIQON/Wo/dH6+ZkFSQ4HnHWpetV2azx9E65dQ
40 changed files with 3331 additions and 158 deletions
Download patch file Download diff file Expand all files Collapse all files

22
docs/CONSUMERS.md
View file

@ -34,8 +34,8 @@ source attribution and application-specific malware/content policy.
## Current contracts
Code version 0.4.0 uses writer schema 5 and `argand.site-rules/v4`.
`COMPLETE.json` uses `argand.site-registry/v2` and binds:
Code version 0.5.0 uses writer schema 5 and `argand.site-rules/v4`.
New compact `COMPLETE.json` files use `argand.site-registry/v3` and bind:
- authenticated `registry.sqlite` bytes;
- the active source coverage graph and exact PSL source;
@ -43,12 +43,23 @@ Code version 0.4.0 uses writer schema 5 and `argand.site-rules/v4`.
- decision-time policy;
- source license and machine-readable attribution files; and
- entity, property, edge and rejection counts.
- every cold audit bundle's digest, size, counts, source, selection state,
attribution digest and coverage digest.
Normal `export` uses `argand.site-export/v2`, contains selected active nonrejected
facts, and marks every assertion `active`. `export-audit` uses the same schema with
mode `audit` and includes superseded/rejected states and rejection reasons. Neither
mode `audit` for v2 generations. Compact generations require their external audit
store and emit `argand.site-export/v3` after verifying every referenced bundle.
Both include superseded/rejected states and rejection reasons. Neither
contains a list of resolver-approved routes.
Keep the audit store separate from the runtime deployment, replicate it by exact
object digest, and run `verify-audit` before retention attestations or audit export.
Runtime resolution verifies the compact generation receipt and database without
opening cold history. A missing audit object therefore does not silently change a
query, but it is an audit/retention failure and blocks any claim of complete
provenance. Retention checkpoints never authorize deletion.
Votes use `argand.site-vote/v1` and the OpenSSH namespace
`argand-site-registry-vote`. Consumers compile them under the exact receipt-bound
policy and trusted query time. Unknown schema or rule versions fail closed.
@ -77,7 +88,8 @@ resolution policy, expiry, revocation continuity or signature verification.
V1 source manifests remain readable as isolated legacy provider/scope streams.
A deliberate legacy-compatible build policy can replay v0.3 reviews, but strict
0.4 builds require votes and reviewer trust. Current readers accept v2 receipts;
0.4 builds require votes and reviewer trust. Current readers accept v2 and compact
v3 receipts;
rollback checks may open pinned v1 receipts with rules v1-v3 only to compare
revocation history.
@ -93,7 +105,7 @@ The last recorded downstream integration replaced Argand's embedded crate with
signed v0.3.0 revision `ac8282093d8a815c6227cff86e1f40714d510bcd` at Argand
commit `d9dfd1585ce21d9c4136bcc24fa01fe3bfb8ed6e`.
Version 0.4 is handed off as a signed standalone revision. Argand should update its
Version 0.5 is handed off as a signed standalone revision. Argand should update its
full Git `rev` in a separate coordinated source/build window, compare contract
changes, and rerun navigation compiler, native resolver, API, abstention,
revocation and clean-process gates. Changing the code dependency does not activate