diff --git a/README.md b/README.md index c225623..93b18eb 100644 --- a/README.md +++ b/README.md @@ -15,7 +15,7 @@ facebook -> Facebook (Wikidata Q355) -> https://www.facebook.com/ The repository contains the library, CLI, schemas, migrations, synthetic fixtures, and independently authenticated public trust roots. It does not place a mutable production database in Git. Publishers import source evidence, collect -signed reviews, and distribute immutable signed registry generations. The current +signed reviews, and distribute immutable signed registry generations. The first public catalog generation is available as a release asset; see [Public catalog](docs/PUBLIC_CATALOG.md). diff --git a/docs/CONSUMERS.md b/docs/CONSUMERS.md index f108cdc..b17c1f4 100644 --- a/docs/CONSUMERS.md +++ b/docs/CONSUMERS.md @@ -102,11 +102,9 @@ revocation history. Never mutate a complete generation to migrate it. See `UPSTREAM.json` records the original Argand extraction baseline and file hashes. Argand's prior integration pinned signed v0.5.0 revision -`3d3e08cdfd303df9fbd347a9bab2ba52ad575759`. Argand now pins the public signed -v0.6.2 source release at `3c89a540d910cb298ba752880efeb1ed157dab43` in -downstream commit `224616eb9f6685d1a656b113b8460fb80c0c5a6b`. -The public beta uses Site Registry as Navigate's authoritative auto-route -catalog. Its native `navigation-catalog/v2` +`3d3e08cdfd303df9fbd347a9bab2ba52ad575759`; the v0.6 downstream pin is recorded +by the Argand integration commit after this source release. The public beta uses Site Registry as +Navigate's authoritative auto-route catalog. Its native `navigation-catalog/v2` file is only a collection- and content-policy-bound serving projection compiled from one exact registry generation; it is not a second independently curated destination catalog. diff --git a/docs/PUBLIC_CATALOG.md b/docs/PUBLIC_CATALOG.md index c723bee..dbbdf89 100644 --- a/docs/PUBLIC_CATALOG.md +++ b/docs/PUBLIC_CATALOG.md @@ -1,14 +1,14 @@ # Public signed catalog -The v0.6.2 Forgejo release publishes the current immutable data generation that -Argand and any other Site Registry consumer can verify and resolve: +The v0.5.0 Forgejo release publishes the first immutable data generation that any +Site Registry consumer can verify and resolve: -- release: -- asset: `argand-site-registry-catalog-v0.6.2.tar.gz` +- release: +- asset: `argand-site-registry-catalog-20260920-v1.tar.gz` - asset SHA-256: - `48b0cdf453862d858c4bec6c564360e1309605e30af9aba1f54a9446b9bdbe41` + `d878fa057397effa5dc729d2fa3a689c8edd1f4112ef1326dd6131b3fdeab63e` - generation pin: - `5e5d8fd5dc1864dc3f4c53ec71cb5ac64f6db592cfbc8cc56f48a444378e2309` + `ede14746da8817aafdf705dd88cfeabbe8d23e1991e43a304acd8eca9249b18a` The release also carries a checksum file and an OpenSSH signature under namespace `argand-site-registry-release`. Verify it against @@ -17,13 +17,13 @@ The signed Git history is the independent channel for the trust root; do not lea the only trusted key from the archive it authenticates. ```bash -sha256sum --check argand-site-registry-catalog-v0.6.2.tar.gz.sha256 +sha256sum --check argand-site-registry-catalog-20260920-v1.tar.gz.sha256 ssh-keygen -Y verify \ -f trust/public-catalog-20260920/publisher-allowed-signers \ -I argand-site-registry-publisher-v1 \ -n argand-site-registry-release \ - -s argand-site-registry-catalog-v0.6.2.tar.gz.sig \ - < argand-site-registry-catalog-v0.6.2.tar.gz + -s argand-site-registry-catalog-20260920-v1.tar.gz.sig \ + < argand-site-registry-catalog-20260920-v1.tar.gz ``` After extraction, verify every member with `SHA256SUMS`, then authenticate the @@ -31,36 +31,25 @@ generation and exact reviewer trust root: ```bash argand-site-registry activate \ - --generation public-release-v0.6.2/catalog \ + --generation public-release-v0.5.0/catalog \ --current current.json \ --allowed-signers trust/public-catalog-20260920/publisher-allowed-signers \ --allowed-reviewers trust/public-catalog-20260920/reviewer-allowed-signers \ --identity argand-site-registry-publisher-v1 argand-site-registry resolve \ - --generation public-release-v0.6.2/catalog \ - --pin 5e5d8fd5dc1864dc3f4c53ec71cb5ac64f6db592cfbc8cc56f48a444378e2309 \ - --query "facebook" + --generation public-release-v0.5.0/catalog \ + --pin ede14746da8817aafdf705dd88cfeabbe8d23e1991e43a304acd8eca9249b18a \ + --query "yahoo mail" ``` ## Scope and trust -The v0.6.2 catalog contains 976 entities, 1,062 official-site edges, 20,178 -multilingual name facts, and Common Crawl Web Graph evidence for 840 domains that -already had imported identity assertions. Graph authority can prioritize review -and disambiguation, but cannot create an identity, official-site assertion, -review, vote, or redirect. The archive includes all 33 authenticated cold audit -objects referenced by the compact runtime generation. - -The bounded Wikidata discovery input is broad but not a representative or -high-demand sample. Its query and selection metadata are included for audit; raw -discovery output is never approval. - -The disclosed policy uses one automated evidence-gate reviewer group rather than -claiming human-review quorum. Fresh exact endpoint observations are required, and -source conflicts or dangerous drift need two groups, so the single automated -reviewer must abstain on those risks. Sticky revocations and -publisher/reviewer-key separation remain enabled. +This first catalog is deliberately small. Its disclosed policy uses one automated +evidence-gate reviewer group rather than claiming human-review quorum. Fresh exact +endpoint observations are required, and source conflicts or dangerous drift need +two groups, so the single automated reviewer must abstain on those risks. Sticky +revocations and publisher/reviewer key separation remain enabled. Consumers decide whether this policy is appropriate for their use. Preserve typed abstentions, retain attribution, and apply independent malware and content policy. @@ -71,12 +60,3 @@ The generation's approvals expire. Installing an immutable archive is not a prom that every decision stays valid forever: use the resolver's requested time, consume cumulative signed revocation feeds when published, and move to a newly signed full generation before relying on renewed decisions. - -## Regular updates - -The public source repository includes the same updater used to refresh candidate -generations. The example systemd timer runs weekly. It can download, authenticate, -import and build, but it holds no publisher key and cannot approve, sign or -activate a candidate. That separation lets any consumer automate evidence updates -without allowing a compromised downloader or changed upstream dataset to silently -change redirects.