# Versioned formats Version 0.6 uses writer schema 5 and `argand.site-rules/v4`. Schema identifiers are independent from the crate version. Unknown schemas and rules fail closed. The Common Crawl domain-rank adapter is new in 0.6, so no older v4 store can contain one of its source manifests. Its replacement scope is `candidate-domains:`, where the digest covers the canonical JSON encoding of the sorted set of registrable domains derived from retained complete website assertions. Retained superseded evidence may enlarge this conservative set but cannot create a route or make a retired assertion active. The importer authenticates and validates every graph row but persists only the selected domains. A changed identity frontier therefore produces a new immutable source identity instead of silently reusing a stale projection. | Artifact | Current schema | Purpose | | --- | --- | --- | | Source manifest | `argand.site-source/v3` | Exact source object, integrity proof, lineage, parser bound and typed coverage | | Generation receipt | `argand.site-registry/v3` | Compact runtime plus content-addressed audit references | | Active/audit JSONL | `argand.site-export/v2` | Source-bearing assertions with selection state | | Compact audit JSONL | `argand.site-export/v3` | Verified external history with bundle references and tombstones | | Cold audit bundle | `argand.site-audit-bundle/v2` | Source manifest and ordered record/fact history | | Audit verification | `argand.site-audit-verification/v1` | Streaming bundle verification totals | | Audit retention checkpoint | `argand.site-audit-retention/v1` | Signed no-delete retention set | | Benchmark report | `argand.site-benchmark/v1` | Source-pinned operation and resource evidence | | Evaluation report | `argand.site-evaluation/v2` | Resolver judgments, latency, and active source lineage | | Evidence bundle | `argand.site-evidence-bundle/v1` | Exact evidence signed by reviewer votes | | Vote | `argand.site-vote/v1` | Authenticated approve/revoke decision | | Review policy | `argand.site-policy/v1` | Threshold, groups, revocation, and separation rules | | Observation batch | `argand.site-observation-source/v1` | Pinned JSONL object and rights | | Observation | `argand.site-observation/v1` | Normalized subject-bound observation | | Observer capture | `argand.site-observer-capture/v1` | Cache-only replay input | | Emergency revocations | `argand.site-revocations/v1` | Cumulative publisher-signed offline block overlay | | Active pointer | `argand.site-current/v2` | Signed generation pin plus revocation continuity | | Diff | `argand.site-diff/v4` | Typed change stream across generations | Source manifest v3 adds explicit `integrity`, `lineage`, and an optional `maximum_record_bytes` parser ceiling to v2 typed coverage. Integrity always contains the locally computed SHA-256 and may also carry a source-bound provider checksum. Lineage names the direct provider, upstream datasets, transformations, and a conservative independence group. A missing legacy lineage serializes as unknown and never becomes evidence of independence. Coverage is one of `full`, `partition`, or `delta`. A delta names its exact base, positive consecutive sequence, and superseded source IDs. A full source cannot compose with active partitions. Overlap, gaps, cycles, missing bases, cross-provider supersession, and mixed legacy/typed frontiers fail the build. Generation v3 uses `runtime_layout: "compact-v1"`. Its local SQLite database keeps the selected source manifests, active facts and projections, review/policy state, and the evidence needed by runtime queries. Each complete source history is first written to an external JSONL object. The receipt binds its SHA-256, length, source, record/fact counts, selected state, attribution digest and coverage digest. `verify-audit` re-hashes and parses every object before an audit export or retention checkpoint. The separate retention signature namespace is `argand-site-registry-audit-retention`; every checkpoint contains `deletion_authorized: false`. Generation v2 remains supported with embedded history for compatibility. The normal export emits selected active facts only and excludes rejected facts. Every assertion has `selection_state: "active"`. Audit export includes active, superseded, and rejected facts; rejected assertions include their reason. Both modes redact Curlie descriptions by default and neither represents approved navigation routes. Use `resolve` for admission. Votes bind the subject kind and fingerprint, evidence-bundle digest, policy digest, reviewer, decision, reason, asserted review time, optional expiry, exact role/locale/country scope, and revocation supersession IDs. Exact JSON bytes are signed with OpenSSH namespace `argand-site-registry-vote`. Writer `accepted_at` is separate and cannot be supplied by the reviewer. Policy fields define base thresholds for names, edges, and equivalences; maximum approval and observation ages; reviewer groups; publisher separation; source and drift holds; and optional stricter `risk_thresholds` for `source_conflict` and `dangerous_drift`. Unknown fields and risk classes fail closed. Emergency feeds retain every authenticated revocation ID across policy epochs, active state, any explicit superseding quorum, and a refresh deadline no more than seven days after the effective time. Exact JSON bytes use OpenSSH namespace `argand-site-registry-revocations`. A feed can overlay a cached generation only when rules, policy, and reviewer trust-root digests match. Feed continuity rejects dropped subjects or vote IDs. A feed from another compatible generation may only add blocks. Removing a block requires the exact full generation so the consumer can recompute the signed superseding quorum; expired feeds fail closed. Legacy source manifests remain readable as isolated `(source, scope)` streams. Legacy 0.3 reviews remain available only through the explicit compatibility policy. New strict builds use votes and a receipt-bound reviewer trust root. The contract decisions are recorded in [ADR 0001](adr/0001-typed-source-coverage.md), [ADR 0002](adr/0002-granular-trust-subjects.md), [ADR 0003](adr/0003-votes-revocations-and-publishers.md), [ADR 0004](adr/0004-active-and-audit-views.md), and [ADR 0005](adr/0005-full-delta-release-identity.md).