release: implement site registry v0.5

docs/FORMATS.md

@@ -1,13 +1,19 @@
 # Versioned formats
 
-Version 0.4 uses writer schema 5 and `argand.site-rules/v4`. Schema identifiers
+Version 0.5 uses writer schema 5 and `argand.site-rules/v4`. Schema identifiers
 are independent from the crate version. Unknown schemas and rules fail closed.
 
 | Artifact | Current schema | Purpose |
 | --- | --- | --- |
-| Source manifest | `argand.site-source/v2` | Exact source object plus typed coverage |
-| Generation receipt | `argand.site-registry/v2` | Hash-bound immutable generation contract |
+| Source manifest | `argand.site-source/v3` | Exact source object, integrity proof, lineage, parser bound and typed coverage |
+| Generation receipt | `argand.site-registry/v3` | Compact runtime plus content-addressed audit references |
 | Active/audit JSONL | `argand.site-export/v2` | Source-bearing assertions with selection state |
+| Compact audit JSONL | `argand.site-export/v3` | Verified external history with bundle references and tombstones |
+| Cold audit bundle | `argand.site-audit-bundle/v2` | Source manifest and ordered record/fact history |
+| Audit verification | `argand.site-audit-verification/v1` | Streaming bundle verification totals |
+| Audit retention checkpoint | `argand.site-audit-retention/v1` | Signed no-delete retention set |
+| Benchmark report | `argand.site-benchmark/v1` | Source-pinned operation and resource evidence |
+| Evaluation report | `argand.site-evaluation/v2` | Resolver judgments, latency, and active source lineage |
 | Evidence bundle | `argand.site-evidence-bundle/v1` | Exact evidence signed by reviewer votes |
 | Vote | `argand.site-vote/v1` | Authenticated approve/revoke decision |
 | Review policy | `argand.site-policy/v1` | Threshold, groups, revocation, and separation rules |
@@ -18,12 +24,30 @@ are independent from the crate version. Unknown schemas and rules fail closed.
 | Active pointer | `argand.site-current/v2` | Signed generation pin plus revocation continuity |
 | Diff | `argand.site-diff/v4` | Typed change stream across generations |
 
-Source manifest v2 coverage is one of `full`, `partition`, or `delta`. A delta
+Source manifest v3 adds explicit `integrity`, `lineage`, and an optional
+`maximum_record_bytes` parser ceiling to v2 typed coverage. Integrity always
+contains the locally computed SHA-256 and may also carry a source-bound provider
+checksum. Lineage names the direct provider, upstream datasets, transformations,
+and a conservative independence group. A missing legacy lineage serializes as
+unknown and never becomes evidence of independence.
+
+Coverage is one of `full`, `partition`, or `delta`. A delta
 names its exact base, positive consecutive sequence, and superseded source IDs.
 A full source cannot compose with active partitions. Overlap, gaps, cycles,
 missing bases, cross-provider supersession, and mixed legacy/typed frontiers fail
 the build.
 
+Generation v3 uses `runtime_layout: "compact-v1"`. Its local SQLite database keeps
+the selected source manifests, active facts and projections, review/policy state,
+and the evidence needed by runtime queries. Each complete source history is first
+written to an external JSONL object. The receipt binds its SHA-256, length, source,
+record/fact counts, selected state, attribution digest and coverage digest.
+`verify-audit` re-hashes and parses every object before an audit export or retention
+checkpoint. The separate retention signature namespace is
+`argand-site-registry-audit-retention`; every checkpoint contains
+`deletion_authorized: false`. Generation v2 remains supported with embedded
+history for compatibility.
+
 The normal export emits selected active facts only and excludes rejected facts.
 Every assertion has `selection_state: "active"`. Audit export includes active,
 superseded, and rejected facts; rejected assertions include their reason. Both