nicweyand/argand-site-registry
1
0
Fork 0
Code Issues Pull requests Projects Releases 7 Packages Wiki Activity Actions

release: implement site registry v0.5
All checks were successful
Standalone registry checks / check (push) Successful in 5m58s
Details

Browse source
This commit is contained in:
Nic Weyand 2026-09-13 14:42:39 -04:00
commit 557ba7cd69
Signed by: nicweyand
SSH key fingerprint: SHA256:2te+ycJIQON/Wo/dH6+ZkFSQ4HnHWpetV2azx9E65dQ
40 changed files with 3331 additions and 158 deletions
Download patch file Download diff file Expand all files Collapse all files

21
docs/TRUST.md
View file

@ -7,9 +7,10 @@ reach consumers.
## What the implementation enforces
Source adapters accept only documented providers and formats. Manifests bind the
Source adapters accept only documented providers and formats. V3 manifests bind the
exact object, origin URL, source-native snapshot, license, retrieval time, byte
length, digest, and typed coverage. Full, partition and delta graphs reject gaps,
length, local digest, source-bound provider checksum where available, per-record
parser ceiling, typed coverage and declared lineage. Full, partition and delta graphs reject gaps,
cycles, overlap, cross-provider replacement and ambiguous active branches. Failed
or incomplete imports cannot replace complete evidence.
@ -19,6 +20,13 @@ entities. Source-specific popularity stays separate from identity. Every fact
keeps source, source identifier, selector, license, retrieval time, confidence and
raw evidence needed for audit.
Lineage declares the direct provider, known upstream datasets, provider
transformations and a conservative independence group. ROR location metadata, for
example, records GeoNames upstream. Unknown legacy lineage stays unknown. Source
assertion count is not reviewer quorum: the current policy grants authority only
to authenticated reviewer identities, independent groups and physical keys, so
two providers cannot manufacture approval by copying one upstream claim.
Names, entity-to-property edges and entity equivalences have independent material
fingerprints. Under the reference policy, `resolve` needs two independent votes
for the matched name and two for the selected edge. Reviewer groups and physical
@ -57,13 +65,20 @@ and malware-policy results without naming a vendor. No such provider is built in
an operator must verify commercial-reuse terms and preserve its exact source and
rights declaration before importing those records.
Generations bind authenticated SQLite bytes, selected coverage, policy, reviewer
Compact generations bind authenticated SQLite bytes, selected coverage, policy, reviewer
trust bytes, licenses, attribution, and decision-time rules into `COMPLETE.json`.
Readers verify the receipt pin and copy the database into a private unlinked file
before SQLite opens it. Release signing and activation reverify every stored
signature. The strict policy rejects a publisher identity or physical key used for
any reviewer vote.
Complete historical records and facts live in content-addressed cold bundles bound
by the same receipt. Their verifier hashes the exact no-follow file descriptor and
checks bytes, JSON order, source identity, selection state, counts, coverage and
attribution. Runtime lookup cannot weaken when cold storage is offline; audit
export and retention fail closed. A separately signed no-delete checkpoint makes
the retained object set explicit without adding deletion authority.
## What a publisher must establish
The software verifies evidence integrity and decision authorization. A publisher