nicweyand/argand-site-registry
1
0
Fork 0
Code Issues Pull requests Projects Releases 7 Packages Wiki Activity Actions

security: harden registry trust and ingestion
All checks were successful
Standalone registry checks / check (push) Successful in 3m47s
Details

Browse source
This commit is contained in:
Nic Weyand 2026-09-13 02:31:51 -04:00
commit 9705b01fe4
Signed by: nicweyand
SSH key fingerprint: SHA256:2te+ycJIQON/Wo/dH6+ZkFSQ4HnHWpetV2azx9E65dQ
25 changed files with 846 additions and 144 deletions
Download patch file Download diff file Expand all files Collapse all files

15
docs/CONSUMERS.md
View file

@ -2,9 +2,11 @@
## Rust library
Use `argand_site_registry::query::Registry::open(generation, trusted_pin)` once per
immutable generation and reuse the reader. `lookup(query, limit)` returns evidence
and complete ambiguity counts; `resolve_explained` returns a reviewed candidate or
Use `release::verify_signed(generation, publisher_signers, publisher_identity,
reviewer_signers)` once per production generation and reuse the returned reader.
`Registry::open(generation, trusted_pin)` is the lower-level path when the pin
distributor is also trusted for the complete review decision. `lookup(query,
limit)` returns evidence and complete ambiguity counts; `resolve_explained` returns a reviewed candidate or
a typed abstention reason with counts. Exact reverse views cover entity IDs,
URLs/domains, popularity and Curlie categories. Check the compiled example and API
docs for exact types. `selection_context` binds the full alternative set for
@ -39,9 +41,10 @@ omits descriptions and includes fact provenance plus an attribution envelope.
It is an assertion export, not a self-contained signed list of admitted routes.
Raw SQL inspection is useful for audit; it does not implement resolution policy.
Code version 0.2.0 uses schema version 2 and `argand.site-rules/v2`.
It adds authenticated reviewer proofs, exact immutable SQLite opening, typed diffs
and audit/evaluation APIs. Schema/rule contracts remain versioned independently in
Code version 0.3.0 uses schema version 3 and `argand.site-rules/v3`.
It adds reviewer-trust enforcement for consumers, private authenticated SQLite
snapshots, exact-stream import checks, bounded outputs and metadata-bound identity
decisions. Schema/rule contracts remain versioned independently in
receipts. Unsupported contracts fail closed. Pin source releases,
compile consumers and replay fixed fixtures before upgrades. Preserve import and
review history; never mutate complete generations to migrate them.