nicweyand/argand-site-registry
1
0
Fork 0
Code Issues Pull requests Projects Releases 7 Packages Wiki Activity Actions

feat: harden reviewed registry releases
All checks were successful
Standalone registry checks / check (push) Successful in 3m43s
Details

Browse source
This commit is contained in:
Nic Weyand 2026-09-13 01:19:27 -04:00
commit e83f43d00f
Signed by: nicweyand
SSH key fingerprint: SHA256:2te+ycJIQON/Wo/dH6+ZkFSQ4HnHWpetV2azx9E65dQ
37 changed files with 2856 additions and 286 deletions
Download patch file Download diff file Expand all files Collapse all files

19
docs/TRUST.md
View file

@ -12,18 +12,22 @@ Destination and identity decisions bind exact evidence fingerprints, including
names, assertions and normalization context. Reviews expire within 90 days.
Changed evidence invalidates earlier approvals. Resolution abstains on ambiguity,
ties, missing approval or ineligible claims; regional scopes must explicitly
match. The local writer owns the append-only review log.
match. Reviewer decisions are signed under a dedicated SSH namespace and the local
writer retains their exact decision/signature bytes in the append-only review log.
Generations bind the database, license document and attribution to a completion
receipt. Consumers provide a trusted hash or verify an external publisher key.
Activation checks signatures and refuses rollback that loses distributed
revocations. Updates build candidates and cannot approve, sign or activate them.
Release signing re-verifies every stored decision against an external reviewer
trust file. Activation checks publisher signatures, rejects structurally incomplete
review proofs and refuses rollback that loses distributed revocations. Updates
build candidates and cannot approve, sign or activate them.
## What a publisher must establish
The reviewer name and evidence locator in a decision are operator assertions.
The CLI validates their structure and evidence binding; it does not independently
authenticate the reviewer, retrieve their evidence or prove website ownership.
The CLI authenticates exact decision bytes to an allowed SSH signer and validates
their structure and evidence binding; it does not retrieve the cited evidence or
prove website ownership.
Protect the writer database and signing key with separate operating permissions.
Restrict who can author decisions and require human review before release signing.
@ -37,8 +41,9 @@ to review. Confidence values are assertion scores, not calibrated probabilities.
Choose expiry based on volatility, within the enforced maximum. Do not renew
blindly on a timer. Expired approval should lead to abstention until evidence is
reviewed. Disclose editorial conflicts and use an independent reviewer for a
disputed claim when possible. The initial implementation is a local single-writer
tool; it does not provide authenticated reviewer accounts or an enforced quorum.
disputed claim when possible. The implementation is a local single-writer tool
with externally authenticated reviewer keys; it does not provide accounts or an
enforced quorum.
## What consumers must preserve