docs: publish the v0.6.2 catalog

README.md

@@ -15,7 +15,7 @@ facebook -> Facebook (Wikidata Q355) -> https://www.facebook.com/
 The repository contains the library, CLI, schemas, migrations, synthetic
 fixtures, and independently authenticated public trust roots. It does not place a
 mutable production database in Git. Publishers import source evidence, collect
-signed reviews, and distribute immutable signed registry generations. The first
+signed reviews, and distribute immutable signed registry generations. The current
 public catalog generation is available as a release asset; see
 [Public catalog](docs/PUBLIC_CATALOG.md).
 

docs/CONSUMERS.md

@@ -102,9 +102,11 @@ revocation history. Never mutate a complete generation to migrate it. See
 
 `UPSTREAM.json` records the original Argand extraction baseline and file hashes.
 Argand's prior integration pinned signed v0.5.0 revision
-`3d3e08cdfd303df9fbd347a9bab2ba52ad575759`; the v0.6 downstream pin is recorded
+`3d3e08cdfd303df9fbd347a9bab2ba52ad575759`. Argand now pins the public signed
-by the Argand integration commit after this source release. The public beta uses Site Registry as
+v0.6.2 source release at `3c89a540d910cb298ba752880efeb1ed157dab43` in
-Navigate's authoritative auto-route catalog. Its native `navigation-catalog/v2`
+downstream commit `224616eb9f6685d1a656b113b8460fb80c0c5a6b`.
+The public beta uses Site Registry as Navigate's authoritative auto-route
+catalog. Its native `navigation-catalog/v2`
 file is only a collection- and content-policy-bound serving projection compiled
 from one exact registry generation; it is not a second independently curated
 destination catalog.

docs/PUBLIC_CATALOG.md

@@ -1,14 +1,14 @@
 # Public signed catalog
 
-The v0.5.0 Forgejo release publishes the first immutable data generation that any
+The v0.6.2 Forgejo release publishes the current immutable data generation that
-Site Registry consumer can verify and resolve:
+Argand and any other Site Registry consumer can verify and resolve:
 
-- release: <https://git.argand.org/nicweyand/argand-site-registry/releases/tag/v0.5.0>
+- release: <https://git.argand.org/nicweyand/argand-site-registry/releases/tag/v0.6.2>
-- asset: `argand-site-registry-catalog-20260920-v1.tar.gz`
+- asset: `argand-site-registry-catalog-v0.6.2.tar.gz`
 - asset SHA-256:
-  `d878fa057397effa5dc729d2fa3a689c8edd1f4112ef1326dd6131b3fdeab63e`
+  `48b0cdf453862d858c4bec6c564360e1309605e30af9aba1f54a9446b9bdbe41`
 - generation pin:
-  `ede14746da8817aafdf705dd88cfeabbe8d23e1991e43a304acd8eca9249b18a`
+  `5e5d8fd5dc1864dc3f4c53ec71cb5ac64f6db592cfbc8cc56f48a444378e2309`
 
 The release also carries a checksum file and an OpenSSH signature under namespace
 `argand-site-registry-release`. Verify it against
@@ -17,13 +17,13 @@ The signed Git history is the independent channel for the trust root; do not lea
 the only trusted key from the archive it authenticates.
 
 ```bash
-sha256sum --check argand-site-registry-catalog-20260920-v1.tar.gz.sha256
+sha256sum --check argand-site-registry-catalog-v0.6.2.tar.gz.sha256
 ssh-keygen -Y verify \
   -f trust/public-catalog-20260920/publisher-allowed-signers \
   -I argand-site-registry-publisher-v1 \
   -n argand-site-registry-release \
-  -s argand-site-registry-catalog-20260920-v1.tar.gz.sig \
+  -s argand-site-registry-catalog-v0.6.2.tar.gz.sig \
-  < argand-site-registry-catalog-20260920-v1.tar.gz
+  < argand-site-registry-catalog-v0.6.2.tar.gz
 ```
 
 After extraction, verify every member with `SHA256SUMS`, then authenticate the
@@ -31,25 +31,36 @@ generation and exact reviewer trust root:
 
 ```bash
 argand-site-registry activate \
-  --generation public-release-v0.5.0/catalog \
+  --generation public-release-v0.6.2/catalog \
   --current current.json \
   --allowed-signers trust/public-catalog-20260920/publisher-allowed-signers \
   --allowed-reviewers trust/public-catalog-20260920/reviewer-allowed-signers \
   --identity argand-site-registry-publisher-v1
 
 argand-site-registry resolve \
-  --generation public-release-v0.5.0/catalog \
+  --generation public-release-v0.6.2/catalog \
-  --pin ede14746da8817aafdf705dd88cfeabbe8d23e1991e43a304acd8eca9249b18a \
+  --pin 5e5d8fd5dc1864dc3f4c53ec71cb5ac64f6db592cfbc8cc56f48a444378e2309 \
-  --query "yahoo mail"
+  --query "facebook"
 ```
 
 ## Scope and trust
 
-This first catalog is deliberately small. Its disclosed policy uses one automated
+The v0.6.2 catalog contains 976 entities, 1,062 official-site edges, 20,178
-evidence-gate reviewer group rather than claiming human-review quorum. Fresh exact
+multilingual name facts, and Common Crawl Web Graph evidence for 840 domains that
-endpoint observations are required, and source conflicts or dangerous drift need
+already had imported identity assertions. Graph authority can prioritize review
-two groups, so the single automated reviewer must abstain on those risks. Sticky
+and disambiguation, but cannot create an identity, official-site assertion,
-revocations and publisher/reviewer key separation remain enabled.
+review, vote, or redirect. The archive includes all 33 authenticated cold audit
+objects referenced by the compact runtime generation.
+
+The bounded Wikidata discovery input is broad but not a representative or
+high-demand sample. Its query and selection metadata are included for audit; raw
+discovery output is never approval.
+
+The disclosed policy uses one automated evidence-gate reviewer group rather than
+claiming human-review quorum. Fresh exact endpoint observations are required, and
+source conflicts or dangerous drift need two groups, so the single automated
+reviewer must abstain on those risks. Sticky revocations and
+publisher/reviewer-key separation remain enabled.
 
 Consumers decide whether this policy is appropriate for their use. Preserve typed
 abstentions, retain attribution, and apply independent malware and content policy.
@@ -60,3 +71,12 @@ The generation's approvals expire. Installing an immutable archive is not a prom
 that every decision stays valid forever: use the resolver's requested time,
 consume cumulative signed revocation feeds when published, and move to a newly
 signed full generation before relying on renewed decisions.
+
+## Regular updates
+
+The public source repository includes the same updater used to refresh candidate
+generations. The example systemd timer runs weekly. It can download, authenticate,
+import and build, but it holds no publisher key and cannot approve, sign or
+activate a candidate. That separation lets any consumer automate evidence updates
+without allowing a compromised downloader or changed upstream dataset to silently
+change redirects.