3.6 KiB
Trust and evidence policy
What the implementation enforces
Inputs use reviewed source adapters and explicit manifests. URL normalization, PSL parsing and stable identities are deterministic. Fact provenance, conflicting evidence and source-specific popularity remain separate. Names and similar hostnames never silently join entities. Invalid URLs and malformed imports fail validation; a partial import does not replace a complete source selection.
Destination and identity decisions bind exact evidence fingerprints, including names, assertions and normalization context. Reviews expire within 90 days. Changed evidence invalidates earlier approvals. Resolution abstains on ambiguity, ties, missing approval or ineligible claims; regional scopes must explicitly match. The local writer owns the append-only review log.
Generations bind the database, license document and attribution to a completion receipt. Consumers provide a trusted hash or verify an external publisher key. Activation checks signatures and refuses rollback that loses distributed revocations. Updates build candidates and cannot approve, sign or activate them.
What a publisher must establish
The reviewer name and evidence locator in a decision are operator assertions. The CLI validates their structure and evidence binding; it does not independently authenticate the reviewer, retrieve their evidence or prove website ownership. Protect the writer database and signing key with separate operating permissions. Restrict who can author decisions and require human review before release signing.
Publish dated evidence supporting the exact entity, URL, relationship, role and
country/locale. Prefer independently corroborated primary evidence with immutable
capture identifiers. Record contrary evidence and uncertainty. TLS, DNS control,
registrable-domain spelling, redirects, sameAs or popularity alone cannot
establish every identity or role claim. Future crawler observations remain inputs
to review. Confidence values are assertion scores, not calibrated probabilities.
Choose expiry based on volatility, within the enforced maximum. Do not renew blindly on a timer. Expired approval should lead to abstention until evidence is reviewed. Disclose editorial conflicts and use an independent reviewer for a disputed claim when possible. The initial implementation is a local single-writer tool; it does not provide authenticated reviewer accounts or an enforced quorum.
What consumers must preserve
Authenticate a release before opening it. Keep the full receipt pin and required
attribution with caches and exports. Use resolve for reviewed destinations, keep
null as abstention, and enforce application-specific malware/content/navigation
policy separately. A verified signature authenticates the publisher, not the truth
of every assertion. An official website may later be compromised.
Deliver revocations to every active consumer and derived catalogue, and bound cache lifetimes. The resolver checks review expiry at query time; a detached cached URL does not recheck itself. Preserve the current review history during rollback. Copying SQLite rows or the JSONL export into a second resolver can bypass these checks; use the native API or CLI for admission decisions.
Community changes
Treat public submissions as untrusted evidence. Do not execute submitted content or copy review decisions into production automatically. Source allowlist and attribution changes need both implementation tests and documented rights review. Reject unknown sources until those checks are complete. Every publisher may apply stricter admission rules, and must state its actual review and incident procedures.