docs: publish the v0.6.2 catalog

docs/PUBLIC_CATALOG.md

@@ -1,14 +1,14 @@
 # Public signed catalog
 
-The v0.5.0 Forgejo release publishes the first immutable data generation that any
-Site Registry consumer can verify and resolve:
+The v0.6.2 Forgejo release publishes the current immutable data generation that
+Argand and any other Site Registry consumer can verify and resolve:
 
-- release: <https://git.argand.org/nicweyand/argand-site-registry/releases/tag/v0.5.0>
-- asset: `argand-site-registry-catalog-20260920-v1.tar.gz`
+- release: <https://git.argand.org/nicweyand/argand-site-registry/releases/tag/v0.6.2>
+- asset: `argand-site-registry-catalog-v0.6.2.tar.gz`
 - asset SHA-256:
-  `d878fa057397effa5dc729d2fa3a689c8edd1f4112ef1326dd6131b3fdeab63e`
+  `48b0cdf453862d858c4bec6c564360e1309605e30af9aba1f54a9446b9bdbe41`
 - generation pin:
-  `ede14746da8817aafdf705dd88cfeabbe8d23e1991e43a304acd8eca9249b18a`
+  `5e5d8fd5dc1864dc3f4c53ec71cb5ac64f6db592cfbc8cc56f48a444378e2309`
 
 The release also carries a checksum file and an OpenSSH signature under namespace
 `argand-site-registry-release`. Verify it against
@@ -17,13 +17,13 @@ The signed Git history is the independent channel for the trust root; do not lea
 the only trusted key from the archive it authenticates.
 
 ```bash
-sha256sum --check argand-site-registry-catalog-20260920-v1.tar.gz.sha256
+sha256sum --check argand-site-registry-catalog-v0.6.2.tar.gz.sha256
 ssh-keygen -Y verify \
   -f trust/public-catalog-20260920/publisher-allowed-signers \
   -I argand-site-registry-publisher-v1 \
   -n argand-site-registry-release \
-  -s argand-site-registry-catalog-20260920-v1.tar.gz.sig \
-  < argand-site-registry-catalog-20260920-v1.tar.gz
+  -s argand-site-registry-catalog-v0.6.2.tar.gz.sig \
+  < argand-site-registry-catalog-v0.6.2.tar.gz
 ```
 
 After extraction, verify every member with `SHA256SUMS`, then authenticate the
@@ -31,25 +31,36 @@ generation and exact reviewer trust root:
 
 ```bash
 argand-site-registry activate \
-  --generation public-release-v0.5.0/catalog \
+  --generation public-release-v0.6.2/catalog \
   --current current.json \
   --allowed-signers trust/public-catalog-20260920/publisher-allowed-signers \
   --allowed-reviewers trust/public-catalog-20260920/reviewer-allowed-signers \
   --identity argand-site-registry-publisher-v1
 
 argand-site-registry resolve \
-  --generation public-release-v0.5.0/catalog \
-  --pin ede14746da8817aafdf705dd88cfeabbe8d23e1991e43a304acd8eca9249b18a \
-  --query "yahoo mail"
+  --generation public-release-v0.6.2/catalog \
+  --pin 5e5d8fd5dc1864dc3f4c53ec71cb5ac64f6db592cfbc8cc56f48a444378e2309 \
+  --query "facebook"
 ```
 
 ## Scope and trust
 
-This first catalog is deliberately small. Its disclosed policy uses one automated
-evidence-gate reviewer group rather than claiming human-review quorum. Fresh exact
-endpoint observations are required, and source conflicts or dangerous drift need
-two groups, so the single automated reviewer must abstain on those risks. Sticky
-revocations and publisher/reviewer key separation remain enabled.
+The v0.6.2 catalog contains 976 entities, 1,062 official-site edges, 20,178
+multilingual name facts, and Common Crawl Web Graph evidence for 840 domains that
+already had imported identity assertions. Graph authority can prioritize review
+and disambiguation, but cannot create an identity, official-site assertion,
+review, vote, or redirect. The archive includes all 33 authenticated cold audit
+objects referenced by the compact runtime generation.
+
+The bounded Wikidata discovery input is broad but not a representative or
+high-demand sample. Its query and selection metadata are included for audit; raw
+discovery output is never approval.
+
+The disclosed policy uses one automated evidence-gate reviewer group rather than
+claiming human-review quorum. Fresh exact endpoint observations are required, and
+source conflicts or dangerous drift need two groups, so the single automated
+reviewer must abstain on those risks. Sticky revocations and
+publisher/reviewer-key separation remain enabled.
 
 Consumers decide whether this policy is appropriate for their use. Preserve typed
 abstentions, retain attribution, and apply independent malware and content policy.
@@ -60,3 +71,12 @@ The generation's approvals expire. Installing an immutable archive is not a prom
 that every decision stays valid forever: use the resolver's requested time,
 consume cumulative signed revocation feeds when published, and move to a newly
 signed full generation before relying on renewed decisions.
+
+## Regular updates
+
+The public source repository includes the same updater used to refresh candidate
+generations. The example systemd timer runs weekly. It can download, authenticate,
+import and build, but it holds no publisher key and cannot approve, sign or
+activate a candidate. That separation lets any consumer automate evidence updates
+without allowing a compromised downloader or changed upstream dataset to silently
+change redirects.