# Versioned formats

Version 0.4 uses writer schema 5 and `argand.site-rules/v4`. Schema identifiers
are independent from the crate version. Unknown schemas and rules fail closed.

| Artifact | Current schema | Purpose |
| --- | --- | --- |
| Source manifest | `argand.site-source/v2` | Exact source object plus typed coverage |
| Generation receipt | `argand.site-registry/v2` | Hash-bound immutable generation contract |
| Active/audit JSONL | `argand.site-export/v2` | Source-bearing assertions with selection state |
| Evidence bundle | `argand.site-evidence-bundle/v1` | Exact evidence signed by reviewer votes |
| Vote | `argand.site-vote/v1` | Authenticated approve/revoke decision |
| Review policy | `argand.site-policy/v1` | Threshold, groups, revocation, and separation rules |
| Observation batch | `argand.site-observation-source/v1` | Pinned JSONL object and rights |
| Observation | `argand.site-observation/v1` | Normalized subject-bound observation |
| Observer capture | `argand.site-observer-capture/v1` | Cache-only replay input |
| Emergency revocations | `argand.site-revocations/v1` | Cumulative publisher-signed offline block overlay |
| Active pointer | `argand.site-current/v2` | Signed generation pin plus revocation continuity |
| Diff | `argand.site-diff/v4` | Typed change stream across generations |

Source manifest v2 coverage is one of `full`, `partition`, or `delta`. A delta
names its exact base, positive consecutive sequence, and superseded source IDs.
A full source cannot compose with active partitions. Overlap, gaps, cycles,
missing bases, cross-provider supersession, and mixed legacy/typed frontiers fail
the build.

The normal export emits selected active facts only and excludes rejected facts.
Every assertion has `selection_state: "active"`. Audit export includes active,
superseded, and rejected facts; rejected assertions include their reason. Both
modes redact Curlie descriptions by default and neither represents approved
navigation routes. Use `resolve` for admission.

Votes bind the subject kind and fingerprint, evidence-bundle digest, policy
digest, reviewer, decision, reason, asserted review time, optional expiry, exact
role/locale/country scope, and revocation supersession IDs. Exact JSON bytes are
signed with OpenSSH namespace `argand-site-registry-vote`. Writer `accepted_at`
is separate and cannot be supplied by the reviewer.

Policy fields define base thresholds for names, edges, and equivalences; maximum
approval and observation ages; reviewer groups; publisher separation; source and
drift holds; and optional stricter `risk_thresholds` for `source_conflict` and
`dangerous_drift`. Unknown fields and risk classes fail closed.

Emergency feeds retain every authenticated revocation ID across policy epochs,
active state, any explicit superseding quorum, and a refresh deadline no more
than seven days after the effective time. Exact JSON bytes use OpenSSH namespace
`argand-site-registry-revocations`. A feed can overlay a cached generation only
when rules, policy, and reviewer trust-root digests match. Feed continuity rejects
dropped subjects or vote IDs. A feed from another compatible generation may only
add blocks. Removing a block requires the exact full generation so the consumer
can recompute the signed superseding quorum; expired feeds fail closed.

Legacy source manifests remain readable as isolated `(source, scope)` streams.
Legacy 0.3 reviews remain available only through the explicit compatibility
policy. New strict builds use votes and a receipt-bound reviewer trust root.

The contract decisions are recorded in [ADR 0001](adr/0001-typed-source-coverage.md),
[ADR 0002](adr/0002-granular-trust-subjects.md),
[ADR 0003](adr/0003-votes-revocations-and-publishers.md),
[ADR 0004](adr/0004-active-and-audit-views.md), and
[ADR 0005](adr/0005-full-delta-release-identity.md).