1.4 KiB
ADR 0005: Full and delta release identities
Status: Accepted, 2026-09-13.
Each source object has its own digest. The selected coverage graph, including every active full, partition, base, and delta object and its precedence, has a separate digest bound into the generation receipt. A future distributed dataset delta must name exact base and target generation identities and preserve revocation continuity.
An unauthenticated latest locator can be a convenience pointer, but never the
trust root. Consumers authenticate a full receipt pin or publisher signature.
Version 0.4 implements source-level full/partition/delta identity and cumulative publisher-signed emergency revocation overlays. General downloadable registry deltas remain a v0.6 distribution task because they also need mirror-independent base/target authentication and consumer transaction semantics.
Rejected alternatives
Mutable releases and unpinned latest URLs permit substitution and rollback.
Signing only a compressed archive makes alternate packaging unverifiable. Calling
a source delta a registry delta would hide changes introduced by review policy,
normalization, observations, or another provider.
Compatibility
V2 receipts bind the selected coverage digest. Current pointers retain every legacy and vote revocation across activation. Emergency feeds apply only when their rules, policy, and reviewer-trust digests match the cached generation.