# Trust and evidence policy

## What the implementation enforces

Inputs use reviewed source adapters and explicit manifests. URL normalization,
PSL parsing and stable identities are deterministic. Fact provenance, conflicting
evidence and source-specific popularity remain separate. Names and similar
hostnames never silently join entities. Invalid URLs and malformed imports fail
validation; a partial import does not replace a complete source selection.

Destination and identity decisions bind exact evidence fingerprints, including
names, assertions and normalization context. Reviews expire within 90 days.
Changed evidence invalidates earlier approvals. Resolution abstains on ambiguity,
ties, missing approval or ineligible claims; regional scopes must explicitly
match. The local writer owns the append-only review log.

Generations bind the database, license document and attribution to a completion
receipt. Consumers provide a trusted hash or verify an external publisher key.
Activation checks signatures and refuses rollback that loses distributed
revocations. Updates build candidates and cannot approve, sign or activate them.

## What a publisher must establish

The reviewer name and evidence locator in a decision are operator assertions.
The CLI validates their structure and evidence binding; it does not independently
authenticate the reviewer, retrieve their evidence or prove website ownership.
Protect the writer database and signing key with separate operating permissions.
Restrict who can author decisions and require human review before release signing.

Publish dated evidence supporting the exact entity, URL, relationship, role and
country/locale. Prefer independently corroborated primary evidence with immutable
capture identifiers. Record contrary evidence and uncertainty. TLS, DNS control,
registrable-domain spelling, redirects, `sameAs` or popularity alone cannot
establish every identity or role claim. Future crawler observations remain inputs
to review. Confidence values are assertion scores, not calibrated probabilities.

Choose expiry based on volatility, within the enforced maximum. Do not renew
blindly on a timer. Expired approval should lead to abstention until evidence is
reviewed. Disclose editorial conflicts and use an independent reviewer for a
disputed claim when possible. The initial implementation is a local single-writer
tool; it does not provide authenticated reviewer accounts or an enforced quorum.

## What consumers must preserve

Authenticate a release before opening it. Keep the full receipt pin and required
attribution with caches and exports. Use `resolve` for reviewed destinations, keep
null as abstention, and enforce application-specific malware/content/navigation
policy separately. A verified signature authenticates the publisher, not the truth
of every assertion. An official website may later be compromised.

Deliver revocations to every active consumer and derived catalogue, and bound cache
lifetimes. The resolver checks review expiry at query time; a detached cached URL
does not recheck itself. Preserve the current review history during rollback.
Copying SQLite rows or the JSONL export into a second resolver can bypass these
checks; use the native API or CLI for admission decisions.

## Community changes

Treat public submissions as untrusted evidence. Do not execute submitted content
or copy review decisions into production automatically. Source allowlist and
attribution changes need both implementation tests and documented rights review.
Reject unknown sources until those checks are complete. Every publisher may apply
stricter admission rules, and must state its actual review and incident procedures.