From 3c89a540d910cb298ba752880efeb1ed157dab43 Mon Sep 17 00:00:00 2001 From: nicweyand Date: Tue, 22 Sep 2026 09:09:41 -0400 Subject: [PATCH 1/2] fix: retain PSL in compact catalogs --- CHANGELOG.md | 5 +++++ Cargo.lock | 4 ++-- Cargo.toml | 2 +- crates/argand-site-registry/src/audit.rs | 3 ++- crates/argand-site-registry/tests/v05.rs | 3 +++ docs/CONSUMERS.md | 2 +- docs/VALIDATION.md | 2 ++ 7 files changed, 16 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ecd31f9..a3bea2f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,10 @@ # Changelog +## 0.6.2 - 2026-09-22 + +- Retain the PSL normalization fact in compact catalogs and exercise the review + queue against the compact runtime rather than only the full writer projection. + ## 0.6.1 - 2026-09-22 - Accept complete Common Crawl domain-rank releases containing provider rows diff --git a/Cargo.lock b/Cargo.lock index 1ec3b30..506a25f 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -78,14 +78,14 @@ checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470" [[package]] name = "argand-atomic" -version = "0.6.1" +version = "0.6.2" dependencies = [ "tempfile", ] [[package]] name = "argand-site-registry" -version = "0.6.1" +version = "0.6.2" dependencies = [ "anyhow", "argand-atomic", diff --git a/Cargo.toml b/Cargo.toml index a4f7ba4..6f02cbe 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -4,7 +4,7 @@ resolver = "3" members = ["crates/argand-atomic", "crates/argand-site-registry"] [workspace.package] -version = "0.6.1" +version = "0.6.2" authors = ["Nic Weyand"] edition = "2024" license = "AGPL-3.0-or-later" diff --git a/crates/argand-site-registry/src/audit.rs b/crates/argand-site-registry/src/audit.rs index a9d270f..392b308 100644 --- a/crates/argand-site-registry/src/audit.rs +++ b/crates/argand-site-registry/src/audit.rs @@ -616,7 +616,8 @@ pub(crate) fn compact_runtime(db: &Connection) -> anyhow::Result<()> { INSERT OR IGNORE INTO runtime_facts SELECT fact FROM names; INSERT OR IGNORE INTO runtime_facts SELECT fact FROM popularity; INSERT OR IGNORE INTO runtime_facts SELECT fact FROM rejected; - INSERT OR IGNORE INTO runtime_facts SELECT item.value FROM edges,json_each(edges.facts) item;", + INSERT OR IGNORE INTO runtime_facts SELECT item.value FROM edges,json_each(edges.facts) item; + INSERT OR IGNORE INTO runtime_facts SELECT id FROM facts WHERE predicate='psl';", )?; db.execute( "DELETE FROM facts WHERE NOT EXISTS(SELECT 1 FROM runtime_facts r WHERE r.id=facts.id)", diff --git a/crates/argand-site-registry/tests/v05.rs b/crates/argand-site-registry/tests/v05.rs index 793e231..023abee 100644 --- a/crates/argand-site-registry/tests/v05.rs +++ b/crates/argand-site-registry/tests/v05.rs @@ -267,6 +267,9 @@ fn compact_generation_keeps_runtime_results_and_authenticates_cold_history() -> serde_json::to_value(full.lookup("Facebook", 20)?.candidates)?, serde_json::to_value(compact.lookup("Facebook", 20)?.candidates)? ); + let compact_queue = + argand_site_registry::queue::review_queue(&compact, common::timestamp()?, 100, 1_000)?; + assert!(!compact_queue.items.is_empty()); assert!( std::fs::metadata(compact_path.join("registry.sqlite"))?.len() < std::fs::metadata(root.path().join("full/registry.sqlite"))?.len() diff --git a/docs/CONSUMERS.md b/docs/CONSUMERS.md index 1433fdb..b17c1f4 100644 --- a/docs/CONSUMERS.md +++ b/docs/CONSUMERS.md @@ -34,7 +34,7 @@ source attribution and application-specific malware/content policy. ## Current contracts -Code version 0.6.1 uses writer schema 5 and `argand.site-rules/v4`. +Code version 0.6.2 uses writer schema 5 and `argand.site-rules/v4`. New compact `COMPLETE.json` files use `argand.site-registry/v3` and bind: - authenticated `registry.sqlite` bytes; diff --git a/docs/VALIDATION.md b/docs/VALIDATION.md index 65e9b7b..309ad3f 100644 --- a/docs/VALIDATION.md +++ b/docs/VALIDATION.md @@ -7,6 +7,8 @@ Patch release 0.6.1 additionally replays the real provider-shaped accounting but is not retained as a DNS target. The following valid `com.facebook` row is retained at its original `row:2` coordinate. Schema and numeric corruption continue to fail closed. +The compact-generation lifecycle now also executes the review queue, proving its +PSL normalization input remains in the runtime catalog. The evaluation contract was written before implementation. The new Common Crawl domain-rank integration passed five default integration tests; its sixth test is From 62e7a67cba70cffd4672102b064aceecac857ca7 Mon Sep 17 00:00:00 2001 From: nicweyand Date: Tue, 22 Sep 2026 09:29:15 -0400 Subject: [PATCH 2/2] docs: publish the v0.6.2 catalog --- README.md | 2 +- docs/CONSUMERS.md | 8 +++--- docs/PUBLIC_CATALOG.md | 56 ++++++++++++++++++++++++++++-------------- 3 files changed, 44 insertions(+), 22 deletions(-) diff --git a/README.md b/README.md index 93b18eb..c225623 100644 --- a/README.md +++ b/README.md @@ -15,7 +15,7 @@ facebook -> Facebook (Wikidata Q355) -> https://www.facebook.com/ The repository contains the library, CLI, schemas, migrations, synthetic fixtures, and independently authenticated public trust roots. It does not place a mutable production database in Git. Publishers import source evidence, collect -signed reviews, and distribute immutable signed registry generations. The first +signed reviews, and distribute immutable signed registry generations. The current public catalog generation is available as a release asset; see [Public catalog](docs/PUBLIC_CATALOG.md). diff --git a/docs/CONSUMERS.md b/docs/CONSUMERS.md index b17c1f4..f108cdc 100644 --- a/docs/CONSUMERS.md +++ b/docs/CONSUMERS.md @@ -102,9 +102,11 @@ revocation history. Never mutate a complete generation to migrate it. See `UPSTREAM.json` records the original Argand extraction baseline and file hashes. Argand's prior integration pinned signed v0.5.0 revision -`3d3e08cdfd303df9fbd347a9bab2ba52ad575759`; the v0.6 downstream pin is recorded -by the Argand integration commit after this source release. The public beta uses Site Registry as -Navigate's authoritative auto-route catalog. Its native `navigation-catalog/v2` +`3d3e08cdfd303df9fbd347a9bab2ba52ad575759`. Argand now pins the public signed +v0.6.2 source release at `3c89a540d910cb298ba752880efeb1ed157dab43` in +downstream commit `224616eb9f6685d1a656b113b8460fb80c0c5a6b`. +The public beta uses Site Registry as Navigate's authoritative auto-route +catalog. Its native `navigation-catalog/v2` file is only a collection- and content-policy-bound serving projection compiled from one exact registry generation; it is not a second independently curated destination catalog. diff --git a/docs/PUBLIC_CATALOG.md b/docs/PUBLIC_CATALOG.md index dbbdf89..c723bee 100644 --- a/docs/PUBLIC_CATALOG.md +++ b/docs/PUBLIC_CATALOG.md @@ -1,14 +1,14 @@ # Public signed catalog -The v0.5.0 Forgejo release publishes the first immutable data generation that any -Site Registry consumer can verify and resolve: +The v0.6.2 Forgejo release publishes the current immutable data generation that +Argand and any other Site Registry consumer can verify and resolve: -- release: -- asset: `argand-site-registry-catalog-20260920-v1.tar.gz` +- release: +- asset: `argand-site-registry-catalog-v0.6.2.tar.gz` - asset SHA-256: - `d878fa057397effa5dc729d2fa3a689c8edd1f4112ef1326dd6131b3fdeab63e` + `48b0cdf453862d858c4bec6c564360e1309605e30af9aba1f54a9446b9bdbe41` - generation pin: - `ede14746da8817aafdf705dd88cfeabbe8d23e1991e43a304acd8eca9249b18a` + `5e5d8fd5dc1864dc3f4c53ec71cb5ac64f6db592cfbc8cc56f48a444378e2309` The release also carries a checksum file and an OpenSSH signature under namespace `argand-site-registry-release`. Verify it against @@ -17,13 +17,13 @@ The signed Git history is the independent channel for the trust root; do not lea the only trusted key from the archive it authenticates. ```bash -sha256sum --check argand-site-registry-catalog-20260920-v1.tar.gz.sha256 +sha256sum --check argand-site-registry-catalog-v0.6.2.tar.gz.sha256 ssh-keygen -Y verify \ -f trust/public-catalog-20260920/publisher-allowed-signers \ -I argand-site-registry-publisher-v1 \ -n argand-site-registry-release \ - -s argand-site-registry-catalog-20260920-v1.tar.gz.sig \ - < argand-site-registry-catalog-20260920-v1.tar.gz + -s argand-site-registry-catalog-v0.6.2.tar.gz.sig \ + < argand-site-registry-catalog-v0.6.2.tar.gz ``` After extraction, verify every member with `SHA256SUMS`, then authenticate the @@ -31,25 +31,36 @@ generation and exact reviewer trust root: ```bash argand-site-registry activate \ - --generation public-release-v0.5.0/catalog \ + --generation public-release-v0.6.2/catalog \ --current current.json \ --allowed-signers trust/public-catalog-20260920/publisher-allowed-signers \ --allowed-reviewers trust/public-catalog-20260920/reviewer-allowed-signers \ --identity argand-site-registry-publisher-v1 argand-site-registry resolve \ - --generation public-release-v0.5.0/catalog \ - --pin ede14746da8817aafdf705dd88cfeabbe8d23e1991e43a304acd8eca9249b18a \ - --query "yahoo mail" + --generation public-release-v0.6.2/catalog \ + --pin 5e5d8fd5dc1864dc3f4c53ec71cb5ac64f6db592cfbc8cc56f48a444378e2309 \ + --query "facebook" ``` ## Scope and trust -This first catalog is deliberately small. Its disclosed policy uses one automated -evidence-gate reviewer group rather than claiming human-review quorum. Fresh exact -endpoint observations are required, and source conflicts or dangerous drift need -two groups, so the single automated reviewer must abstain on those risks. Sticky -revocations and publisher/reviewer key separation remain enabled. +The v0.6.2 catalog contains 976 entities, 1,062 official-site edges, 20,178 +multilingual name facts, and Common Crawl Web Graph evidence for 840 domains that +already had imported identity assertions. Graph authority can prioritize review +and disambiguation, but cannot create an identity, official-site assertion, +review, vote, or redirect. The archive includes all 33 authenticated cold audit +objects referenced by the compact runtime generation. + +The bounded Wikidata discovery input is broad but not a representative or +high-demand sample. Its query and selection metadata are included for audit; raw +discovery output is never approval. + +The disclosed policy uses one automated evidence-gate reviewer group rather than +claiming human-review quorum. Fresh exact endpoint observations are required, and +source conflicts or dangerous drift need two groups, so the single automated +reviewer must abstain on those risks. Sticky revocations and +publisher/reviewer-key separation remain enabled. Consumers decide whether this policy is appropriate for their use. Preserve typed abstentions, retain attribution, and apply independent malware and content policy. @@ -60,3 +71,12 @@ The generation's approvals expire. Installing an immutable archive is not a prom that every decision stays valid forever: use the resolver's requested time, consume cumulative signed revocation feeds when published, and move to a newly signed full generation before relying on renewed decisions. + +## Regular updates + +The public source repository includes the same updater used to refresh candidate +generations. The example systemd timer runs weekly. It can download, authenticate, +import and build, but it holds no publisher key and cannot approve, sign or +activate a candidate. That separation lets any consumer automate evidence updates +without allowing a compromised downloader or changed upstream dataset to silently +change redirects.